HIGH7.8PyPI
GHSA-j884-q54q-mmx3· CVE-2026-54621, PYSEC-2026-3561`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
Modified: 9/10/2026
package
PyPI/datamodel-code-generator
pkg:pypi/datamodel-code-generator
HIGH7.8PyPI
GHSA-m34r-v34r-rf9q· CVE-2026-54655, PYSEC-2026-3562`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
Modified: 8/4/2026
LOW3.7PyPI
GHSA-r5vv-ff45-prp2· CVE-2026-55403, PYSEC-2026-3563datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
Modified: 9/10/2026
HIGH8.2PyPI
GHSA-rfr2-mq9m-x2qx· CVE-2026-54691, PYSEC-2026-3564datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-vx7x-vcc2-c44g· CVE-2026-55391, PYSEC-2026-3565datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
Modified: 9/10/2026
HIGH7.8PyPI
GHSA-wjv6-jcfj-mf9r· CVE-2026-54654, PYSEC-2026-3566`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
Modified: 9/10/2026
HIGH8.8PyPI
PYSEC-2026-3555· CVE-2026-54653, GHSA-386q-5hp3-95m9`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
Modified: 8/4/2026
HIGH7.5PyPI
PYSEC-2026-3556· CVE-2026-55390, GHSA-442q-2j6p-642gdatamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
Modified: 8/4/2026
HIGH7.5PyPI
PYSEC-2026-3557· CVE-2026-55415, GHSA-5578-w22f-pfx9datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
Modified: 8/4/2026
HIGH7.5PyPI
PYSEC-2026-3558· CVE-2026-55389, GHSA-8359-h9fx-j6v9datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
Modified: 8/4/2026
HIGH7.8PyPI
PYSEC-2026-3559· CVE-2026-54656, GHSA-8m8r-38jm-f355`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
Modified: 8/4/2026
HIGH8.2PyPI
PYSEC-2026-3560· CVE-2026-54690, GHSA-954p-556p-r752datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
Modified: 8/4/2026
HIGH7.8PyPI
PYSEC-2026-3561· CVE-2026-54621, GHSA-j884-q54q-mmx3`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
Modified: 8/4/2026
HIGH7.8PyPI
PYSEC-2026-3562· CVE-2026-54655, GHSA-m34r-v34r-rf9q`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
Modified: 8/4/2026
LOW3.7PyPI
PYSEC-2026-3563· CVE-2026-55403, GHSA-r5vv-ff45-prp2datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
Modified: 8/4/2026
HIGH8.2PyPI
PYSEC-2026-3564· CVE-2026-54691, GHSA-rfr2-mq9m-x2qxdatamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
Modified: 8/4/2026
HIGH7.5PyPI
PYSEC-2026-3565· CVE-2026-55391, GHSA-vx7x-vcc2-c44gdatamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
Modified: 8/4/2026
HIGH7.8PyPI
PYSEC-2026-3566· CVE-2026-54654, GHSA-wjv6-jcfj-mf9r`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
Modified: 8/4/2026
HIGH8.8PyPI
GHSA-386q-5hp3-95m9· CVE-2026-54653, PYSEC-2026-3555`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-442q-2j6p-642g· CVE-2026-55390, PYSEC-2026-3556datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
Modified: 8/12/2026
HIGH7.5PyPI
GHSA-5578-w22f-pfx9· CVE-2026-55415, PYSEC-2026-3557datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-8359-h9fx-j6v9· CVE-2026-55389, PYSEC-2026-3558datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
Modified: 9/10/2026
HIGH7.8PyPI
GHSA-8m8r-38jm-f355· CVE-2026-54656, PYSEC-2026-3559`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
Modified: 8/4/2026
HIGH8.2PyPI
GHSA-954p-556p-r752· CVE-2026-54690, PYSEC-2026-3560datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
Modified: 9/10/2026