The vulnerability arises from datamodel‑code‑generator's http.get_body function, which accepts a --url parameter without validating the host or IP address. The function follows redirects, allowing an attacker to target internal network resources such as loopback, private, link‑local, or metadata IPs. This flaw is an instance of CWE‑918, a server‑side request forgery that can lead to unintended disclosure of internal data or, in some scenarios, execution of code on the internal network if the target service processes malicious content.

Affected products are koxudaxi's datamodel‑code‑generator. All releases from version 0.9.1 through 0.60.x contain the flaw; the issue is fixed starting with 0.61.0. Users running any earlier version and supplying a --url argument are vulnerable.

The CVSS base score of 8.2 marks the flaw as high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the tool can be invoked by an attacker who can supply arbitrary URLs, an adversary able to run the generator on a shared environment could conduct internal reconnaissance or launch further attacks by directing the generator to sensitive internal services. Upgrading to 0.61.0 removes the lack of host/IP validation and mitigates all known risks.