The vulnerability resides in datamodel‑code‑generator’s handling of JSON Schema definitions that reference external HTTP or HTTPS URLs via the $ref keyword. From version 0.9.1 until 0.61.0 the tool silently dereferenced these external references without user confirmation, enabling an attacker to supply a malicious schema that causes the generator to make outbound HTTP requests. This behavior allows a server‑side request forgery (SSRF) that can probe internal networks, exfiltrate data, or reach otherwise inaccessible services, thereby compromising confidentiality, integrity, or availability of the internal environment. The weakness is classified as CWE‑918.

The affected product is datamodel‑code‑generator by koxudaxi. All releases from 0.9.1 up through 0.60.x are vulnerable. The issue was resolved in release 0.61.0, so only installations using earlier versions are at risk.

The CVSS score of 8.2 indicates a high severity of the flaw. The EPSS score of less than 1% suggests that the likelihood of real‑world exploitation is currently low, and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to be able to supply or influence the JSON Schema input processed by the generator, which is common in automated code‑generation workflows or CI/CD pipelines. If such an attacker successfully exploits the flaw, they can force the generator to reach arbitrary URLs within the organization’s network, leading to information disclosure or further attacks.