Security readout for executives and security teams
Plain-English summary
A flaw in datamodel-code-generator can let an attacker-supplied URL evade private-network protections through DNS rebinding. A vulnerable service could then connect to internal systems, potentially exposing sensitive data or enabling limited modification. The affected condition is fixed in version 0.63.0.
Executive priority
Prioritize rapid remediation for internet-facing or multi-tenant services that generate models from user-supplied URLs and can reach internal networks. Other deployments should still upgrade promptly after confirming compatibility. The high severity reflects possible sensitive-data exposure, although exploitation requires a DNS timing condition.
Technical view
Before 0.63.0, URL validation resolves and checks the hostname once, but httpx resolves it again when connecting. An attacker can change the DNS answer between those operations, bypassing allow_private_network=False. This time-of-check/time-of-use flaw enables server-side request forgery into otherwise restricted networks.
Likely exposure
Exposure is most likely where versions earlier than 0.63.0 process attacker-controlled or untrusted remote URLs and run with network access to internal services. Installations using only trusted local inputs, or with effective outbound network isolation, have lower practical exposure.
Exploitation context
The source bundle lists a public exploit reference, indicating technical reproduction information may be available. However, the CVE is not listed as KEV, and the supplied sources do not establish active exploitation in the wild. Exploitation complexity is rated high.
Researcher notes
The weakness combines incomplete hostname validation, DNS rebinding, and a check-to-use race, corresponding to CWE-350, CWE-367, and CWE-918. Review should focus on trust boundaries around URL ingestion, secondary DNS resolution, and reachable internal assets. The supplied bundle does not quantify real-world affected deployments.
Mitigation direction
- Upgrade datamodel-code-generator to version 0.63.0 or later.
- Restrict remote URL inputs to trusted sources until upgrading.
- Limit the generator's outbound access to internal services and sensitive network ranges.
- Review the vendor advisory and release notes for deployment-specific guidance.
Validation and detection
- Inventory installed datamodel-code-generator versions across development, CI, and hosted services.
- Identify workflows that accept remote schemas or other URLs from untrusted users.
- Confirm vulnerable workloads cannot reach internal services through outbound connections.
- Verify upgraded environments report version 0.63.0 or later.
- Review network logs for unexpected requests from systems running the generator.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-350: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-367: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-55391 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N2.24.7GitHub_MVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-vx7x-vcc2-c44gCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/koxudaxi/datamodel-code-generator/commit/25c8b7e497419eb20b230fa3318c04f9bebc5a6fCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0CVE reference, GitHub_M · x_refsource_MISC
- https://gist.github.com/thegr1ffyn/c1d54dd6ff2a4c0d7d0dabe00c4985f4CVE reference, CISA-ADP · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Reliance on Reverse DNS Resolution for a Security-Critical Action
Reliance on Reverse DNS Resolution for a Security-Critical Action represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.