CVE-2026-55403

Received Received - Intake

Header Injection in datamodel-code-generator

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-55403

Affected Vendors & Products

Vendor	Product	Version / Range
datamodel-code-generator	datamodel_code_generator	0.63.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

The vulnerability in datamodel-code-generator before version 0.63.0 allows HTTP headers like Authorization, Cookie, and Proxy-Authorization to be reused when following cross-origin redirects. This means credentials intended for one host could be sent to another host during schema fetching, potentially leaking sensitive data.

Detection Guidance

This vulnerability involves header reuse during cross-origin redirects in datamodel-code-generator versions before 0.63.0. To detect it, check the version of datamodel-code-generator installed on your system using the command: pip show datamodel-code-generator. If the version is below 0.63.0, the system is vulnerable.

Impact Analysis

If you use this tool to fetch schemas from remote sources, attackers could intercept credentials or session tokens sent during redirects. This may lead to unauthorized access to systems or data associated with the leaked credentials.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive authentication credentials (Authorization, Cookie, Proxy-Authorization headers) during cross-origin redirects. This may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information integrity).

Mitigation Strategies

Upgrade datamodel-code-generator to version 0.63.0 or later immediately. Use the command: pip install --upgrade datamodel-code-generator. Additionally, review any automated processes or scripts using this tool to ensure they are updated.

Hi! I’m here to help you understand CVE-2026-55403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70