IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-07-28 22:17

MODIFIED

2026-07-28 22:17

CVSS_SCORE V3

7.5

EPSS (Prob. Exploit)

0.31%

Top 76.7%

DATA SOURCES:

NVD 🔗 2026-07-28 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-10-29 OSV 🔗 2026-11-02

> DESCRIPTION

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for the connection, allowing DNS rebinding to bypass allow_private_network=False and reach internal services. This issue is fixed in version 0.63.0.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

EXPLOITABILITY

2.2

IMPACT

4.7

> MÉTRIQUES CVSS DÉTAILLÉES

                CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
            

Métrique	Valeur	Interprétation
AV (Vecteur d'Attaque) Attack Vector	Network (N)	Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque) Attack Complexity	High (H)	Conditions spécifiques doivent être réunies pour exploiter
PR (Privilèges Requis) Privileges Required	None (N)	Aucune authentification requise
UI (Interaction Utilisateur) User Interaction	None (N)	Aucune interaction utilisateur nécessaire
S (Périmètre) Scope	Changed (C)	Impact s'étend au-delà du composant compromis
C (Impact Confidentialité) Confidentiality Impact	High (H)	Divulgation totale d'informations
I (Impact Intégrité) Integrity Impact	Low (L)	Modification limitée des données possible
A (Impact Disponibilité) Availability Impact	None (N)	Aucune interruption de service

> RÉSUMÉ DES IMPACTS

Confidentialité

High

Divulgation totale d'informations

Intégrité

Low

Modification limitée des données possible

Disponibilité

None

Aucune interruption de service

> WEAKNESSES

CWE-350 CWE-367 CWE-918

> CWE DETAILED DESCRIPTIONS

CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action - The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. | CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition - The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. | CWE-918: Server-Side Request Forgery - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

> GITHUB SECURITY ADVISORY

GHSA-vx7x-vcc2-c44g HIGH

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

AFFECTED PACKAGES:

PIP / datamodel-code-generator

<= 0.62.0

Fixed in: 0.63.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

AFFECTED PACKAGES:

Unknown / Unknown

252 versions affected

ALIASES:

GHSA-vx7x-vcc2-c44g, PYSEC-2026-3565

> HISTORIQUE DES MODIFICATIONS

Première apparition

28/07/2026 22:17

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

Nouvelle valeur:

📊 ENRICHISSEMENT 01/08/2026 06:01

CWE