datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JS…

CVE-2026-54690 affects datamodel-code-generator versions 0.9.1 through 0.61.0, a tool that generates Pydantic v2 models and other data structures from various schema formats. The vulnerability allows server-side request forgery (SSRF) by silently dereferencing attacker-controlled JSON Schema $ref HTTP/HTTPS URLs. The flaw exists in src/datamodel_code_generator/parser/jsonschema.py via the _get_ref_body function. The --allow-remote-refs flag, intended as a security gate, only warns rather than blocking the malicious requests, making it ineffective as a control. The HTTP request logic in src/datamodel_code_generator/http.py is the mechanism through which the SSRF occurs. An attacker supplying a malicious schema could cause the server running datamodel-code-generator to make arbitrary outbound HTTP/HTTPS requests. The issue has been patched in version 0.61.0 of the library.