CVE-2026-54691 koxudaxi CVE debrief

Who should care

Defenders responsible for Python environments using the datamodel-code-generator package should assess exposure and apply the fix. This includes teams managing dependencies in their Python projects.

Why it matters

CVE-2026-54691 is a high-severity server-side request forgery vulnerability in the datamodel-code-generator package. Defenders should prioritize verifying exposure in their Python environments and apply the fix from version 0.61.0. Evidence is limited on specific exploitation or impact, so verification and remediation are crucial.

• Potential unauthorized access to sensitive network resources.
• Possible data breaches or leaks due to SSRF.
• Need for verification of exposure in Python environments.
• Priority on updating to version 0.61.0 or later.

Technical summary

The datamodel-code-generator package generates Python data models from schema definitions. Versions from 0.9.1 until 0.61.0 contain a server-side request forgery vulnerability due to missing host/IP validation in the http.get_body function. This allows attackers to access loopback, private, link-local, metadata, and other network-accessible resources. The vulnerability is fixed in version 0.61.0, and defenders should prioritize verifying exposure in their Python environments and applying the fix. Evidence on specific exploitation or impact is limited.

Defensive priority

Defenders should prioritize verifying exposure in their Python environments using the affected package version and applying the fix from version 0.61.0.

Recommended defensive actions

• Verify if Python environments are using affected versions of the datamodel-code-generator package.
• Apply the fix by updating to version 0.61.0 or later.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. However, additional information on potential exploitation or specific attack scenarios is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.