datamodel-code-generator is a Python tool that creates data models from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf and raw data formats. Prior to version 0.63.0 the tool performed a single host validation when building URLs but then allowed the httpx library to resolve the host again, enabling a DNS rebinding attack that bypassed the allow_private_network flag. The result is a Server Side Request Forgery mechanism that can reach private internal services and exfiltrate data, and it maps to CWE-918, CWE-367 and CWE-350 due to insufficient URL validation and host checking.

The affected vendor is koxudaxi and the product is datamodel-code-generator. All releases prior to 0.63.0 are vulnerable; the issue was fixed in version 0.63.0 and later. No other vendors or products are listed as impacted.

The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1%, implying a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can supply a malicious URL to the generator can trigger DNS rebinding, redirecting the request to internal services and potentially leaking sensitive information or enabling lateral movement within the internal network. Successful exploitation requires network access to the tool and the ability to influence the URL argument.