datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
koxudaxi:datamodel-code-generator
References 4
https://github.com/koxudaxi/datamodel-code-generator/commit/25c8b7e497419eb20b2…
security-advisories@github.com
https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0
security-advisories@github.com
https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-v…
security-advisories@github.com
https://gist.github.com/thegr1ffyn/c1d54dd6ff2a4c0d7d0dabe00c4985f4
134c704f-9b21-4f2e-91b3-4a467353bcc0