CVE-2026-55391General(koxudaxi / datamodel-code-generator)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch koxudaxi datamodel-code-generator systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.

koxudaxi CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/koxudaxi/datamodel-code-generator/commit/25c8b7e497419eb20b230fa3318c04f9bebc5a6f

Exploit / PoC references

https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-vx7x-vcc2-c44g

Vendor / third-party advisories

https://gist.github.com/thegr1ffyn/c1d54dd6ff2a4c0d7d0dabe00c4985f4

Other references

https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0

Weakness type (CWE)

CWE-350CWE-367CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

datamodel-code-generator

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 3 classified signals
Peaked 1d ago at 2 mentions (2026-07-29); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

koxudaxi

Products

datamodel-code-generator

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

General

375.0%

Patch

125.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-23	1	General1
2026-07-29	2	General2
2026-08-01	1	Patch1

Full discourse4 posts

Hamza@TheGr1ffyn91d
General
CVE-2026-54621 CVE-2026-54653 CVE-2026-54654 CVE-2026-54655 CVE-2026-54656 CVE-2026-54690 CVE-2026-54691 CVE-2026-55415 CVE-2026-55389 CVE-2026-55390 CVE-2026-55391 CVE-2026-55403
Post summary
The content is a straightforward list of CVE identifiers with no additional context or actionable information.
1000061
132 followersView on X
DFIR Lab@DFIR_Lab52d
Patch
🚨 HIGH Severity: CVE-2026-55391 (CVSS 7.5) datamodel-code-generator DNS rebinding flaw bypasses network restrictions, exposing internal services. ✅ Update to v0.63.0 immediately #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/ZMTzj2kbBL
Post summary
This tweet warns of a DNS rebinding flaw (CVE‑2026‑55391) in datamodel‑code‑generator that can expose internal services, scoring a CVSS of 7.5, and urges users to update to v0.63.0 immediately.
0000046
99 followersView on X
Infoflowcloud@infoflowcloud55d
General
🚨*CVE* CVE-2026-55391 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YA… https://www.cve.org/CVERecord?id=CVE-2026-55391 ----- Traducción: CVE-2026-55391 dat… http://infoflow.cloud`
Post summary
The text merely references CVE‑2026‑55391 and provides a link to its record, without any technical details, exploit information, or mitigation guidance.
0000027
96 followersView on X
CVE@CVEnew55d
General
CVE-2026-55391 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YA… https://www.cve.org/CVERecord?id=CVE-2026-55391
Post summary
The post simply cites a CVE related to datamodel-code-generator without providing any PoC, exploit, patch information, or technical details, indicating a general mention rather than actionable intelligence.
00000737
57.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	koxudaxi	datamodel-code-generator	-	-	-

Explore more

Back to dashboard koxudaxi CVEs datamodel-code-generator vulnerabilities

What researchers are saying

CVE-2026-55391

DFIR Lab[verified]@DFIR_LabPatch

This tweet warns of a DNS rebinding flaw (CVE‑2026‑55391) in datamodel‑code‑generator that can expose internal services, scoring a CVSS of 7.5, and urges users to update to v0.63.0 immediately.

Hamza@TheGr1ffynGeneral

The content is a straightforward list of CVE identifiers with no additional context or actionable information.

Infoflowcloud@infoflowcloudGeneral

The text merely references CVE‑2026‑55391 and provides a link to its record, without any technical details, exploit information, or mitigation guidance.

CVE@CVEnewGeneral

The post simply cites a CVE related to datamodel-code-generator without providing any PoC, exploit, patch information, or technical details, indicating a general mention rather than actionable intelligence.