Skip to content
OpenAdvisories
Low · 3.7 CVE-2026-55403 EUVD-2026-50070GHSA-r5vv-ff45-prp2PYSEC-2026-3563

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

Published Jul 28, 2026 · Updated Jul 29, 2026 · Assigned by GitHub_M

Description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.

Affected products

VendorProductAffectedFixed
koxudaxi datamodel-code-generator < 0.63.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-datamodel-code-generator 0.72.3-1.1 openSUSE-SU-2026:11538-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI datamodel-code-generator < 0.63.0 0.63.0 GHSA-r5vv-ff45-prp2

Advisories 1

References