CyberRota Analysis
AI-GeneratedThe vulnerability exists in the datamodel-code-generator, specifically in the http.get_body function, which improperly validates URLs, enabling server-side request forgery (SSRF) attacks against various network resources. This could allow an attacker to access sensitive internal services or metadata, posing a significant risk to applications using affected versions from 0.9.1 to 0.61.0. Organizations utilizing this tool should prioritize upgrading to version 0.61.0 or later to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.