# datamodel-code-generator (PyPI) vulnerabilities 13 known vulnerabilities (12 high, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.91.0 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 0.91.0 (Nov 7, 2026), the latest release - Weekly downloads: 3.9M - Dependents: 203 - Releases: 295 since 0.0.1 (Jul 23, 2019) - Registry: https://pypi.org/project/datamodel-code-generator/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-107377: 0.59.0 to 0.80.0 (0.81.0 is outside it) - CVE-2026-55389: 0.0.1 to 0.61.0 (0.62.0 is outside it) - CVE-2026-54653: 0.17.0 to 0.60.1 (0.60.2 is outside it) - CVE-2026-55391: 0.0.1 to 0.62.0 (0.63.0 is outside it) - CVE-2026-54656: 0.52.1 to 0.60.1 (0.60.2 is outside it) - CVE-2026-54690: 0.9.1 to 0.60.2 (0.61.0 is outside it) - CVE-2026-55415: 0.11.6 to 0.63.0 (0.64.0 is outside it) - CVE-2026-54621: 0.25.0 to 0.60.0 (0.60.1 is outside it) - CVE-2026-54655: 0.51.0 to 0.60.1 (0.60.2 is outside it) - CVE-2026-55403: 0.0.1 to 0.62.0 (0.63.0 is outside it) - CVE-2026-54691: 0.9.1 to 0.60.2 (0.61.0 is outside it) - CVE-2026-55390: 0.59.0 to 0.61.0 (0.62.0 is outside it) - CVE-2026-54654: 0.14.1 to 0.60.1 (0.60.2 is outside it) ## Advisories (13) ### [CVE-2026-107377](https://cve.now/CVE-2026-107377): datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory - Severity: High 7.5 - Published: Oct 8, 2026 - Affected: from 0.59.0, fixed in 0.81.0. - Fixed in 0.81.0 (released Sep 14, 2026, 24 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-55389](https://cve.now/CVE-2026-55389): datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema \`$ref\` (\`file://\` and \`../\` traversal), bypassing… - Severity: High 7.5 - Published: Jul 28, 2026 - Affected: fixed in 0.62.0. - Fixed in 0.62.0 (released Jun 10, 2026, 48 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-54653](https://cve.now/CVE-2026-54653): \`datamodel-code-generator\` vulnerable to code injection in via attacker-controlled \`default\_factory\` schema field - Severity: High 8.8 - Published: Jul 28, 2026 - Affected: from 0.17.0, fixed in 0.60.2. - Fixed in 0.60.2 (released Jun 8, 2026, 50 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-55391](https://cve.now/CVE-2026-55391): datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding - Severity: High 7.5 - Published: Jul 28, 2026 - Affected: fixed in 0.63.0. - Fixed in 0.63.0 (released Jun 12, 2026, 46 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-54656](https://cve.now/CVE-2026-54656): \`datamodel-code-generator\` vulnerable to code execution on import via unescaped \`validators\` entries in --extra-template-data - Severity: High 7.8 - Published: Jul 28, 2026 - Affected: from 0.52.1, fixed in 0.60.2. - Fixed in 0.60.2 (released Jun 8, 2026, 50 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-54690](https://cve.now/CVE-2026-54690): datamodel-code-generator vulnerable to SSRF via JSON-Schema \`$ref\` to HTTP URL (silent by default) - Severity: High 8.2 - Published: Jul 28, 2026 - Affected: from 0.9.1, fixed in 0.61.0. - Fixed in 0.61.0 (released Jun 8, 2026, 50 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-55415](https://cve.now/CVE-2026-55415): datamodel-code-generator vulnerable to code injection via \`x-python-import\` / \`customTypePath\` in generated import statements - Severity: High 7.5 - Published: Jul 28, 2026 - Affected: from 0.11.6, fixed in 0.64.0. - Fixed in 0.64.0 (released Jun 14, 2026, 44 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-54621](https://cve.now/CVE-2026-54621): \`datamodel-code-generator\` vulnerable to code injection via unescaped carriage return in GraphQL Union description - Severity: High 7.8 - Published: Jul 28, 2026 - Affected: from 0.25.0, fixed in 0.60.1. - Fixed in 0.60.1 (released Jun 7, 2026, 51 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-54655](https://cve.now/CVE-2026-54655): \`datamodel-code-generator\` vulnerable to code execution on import via \`x-python-type\` JSON-Schema extension in datamodel-code-generator - Severity: High 7.8 - Published: Jul 28, 2026 - Affected: from 0.51.0, fixed in 0.60.2. - Fixed in 0.60.2 (released Jun 8, 2026, 50 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-55403](https://cve.now/CVE-2026-55403): datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas - Severity: Low 3.7 - Published: Jul 28, 2026 - Affected: fixed in 0.63.0. - Fixed in 0.63.0 (released Jun 12, 2026, 46 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-54691](https://cve.now/CVE-2026-54691): datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects - Severity: High 8.2 - Published: Jul 28, 2026 - Affected: from 0.9.1, fixed in 0.61.0. - Fixed in 0.61.0 (released Jun 8, 2026, 50 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-55390](https://cve.now/CVE-2026-55390): Arbitrary local file read via XSD \`schemaLocation\` (\`xs:include\`/\`xs:import\`) path traversal, with no remote-ref gate - Severity: High 7.5 - Published: Jul 28, 2026 - Affected: from 0.59.0, fixed in 0.62.0. - Fixed in 0.62.0 (released Jun 10, 2026, 48 days before disclosure). - The latest release, 0.91.0, is not affected. ### [CVE-2026-54654](https://cve.now/CVE-2026-54654): \`datamodel-code-generator\` vulnerable to code injection via unescaped carriage return in \`--extra-template-data\` \`comment\` field - Severity: High 7.8 - Published: Jul 28, 2026 - Affected: from 0.14.1, fixed in 0.60.2. - Fixed in 0.60.2 (released Jun 8, 2026, 50 days before disclosure). - The latest release, 0.91.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/datamodel-code-generator Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.