CyberRota Analysis
AI-GeneratedThe datamodel-code-generator prior to version 0.63.0 is vulnerable to DNS rebinding attacks, which can allow an attacker to bypass network restrictions and access internal services by exploiting the host resolution process. This vulnerability poses a significant risk to organizations using the affected versions, particularly those with sensitive internal services that could be exposed through this flaw. Users of datamodel-code-generator should prioritize upgrading to version 0.63.0 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)