Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Koxudaxi
Datamodel Code Generator

koxudaxi/datamodel-code-generator: Functions Patched by CVE Fixes

python

#457 of 500 repositories

koxudaxi/datamodel-code-generator

Functions and files changed by CVE fixes in this repository.

Latest located fix July 28, 2026

13

CVE fixes located

Published CVEs

54

Functions patched

Distinct function sites

18

Files patched

Distinct source files

2026

Years covered

By CVE publication date

Overview

13 published CVEs have a fix traced to functions in koxudaxi/datamodel-code-generator, the earliest published in 2026. Those fixes changed 54 distinct functions across 18 files, in 120 patch hunks.

Among the 500 repositories tracked here, koxudaxi/datamodel-code-generator ranks #457 by the number of CVEs with a located fix.

Most patched functions

Functions in koxudaxi/datamodel-code-generator changed by the most CVE fixes.

1_get_ref_bodysrc/datamodel_code_generator/parser/jsonschema.py3 CVEs · 2 patches2026
2get_bodysrc/datamodel_code_generator/http.py3 CVEs · 2 patches2026
3validatessrc/datamodel_code_generator/http.py2 CVEs · 2 patches2026
4_get_httpxsrc/datamodel_code_generator/http.py2 CVEs · 2 patches2026
5run_generate_from_configsrc/datamodel_code_generator/__main__.py2 CVEs · 1 patches2026
6mainsrc/datamodel_code_generator/__main__.py2 CVEs · 1 patches2026
7generatesrc/datamodel_code_generator/__init__.py2 CVEs · 1 patches2026
8_get_text_from_urlsrc/datamodel_code_generator/parser/base.py2 CVEs · 1 patches2026
9start_sectionsrc/datamodel_code_generator/arguments.py2 CVEs · 1 patches2026
10validate_class_name_affix_scopesrc/datamodel_code_generator/__main__.py2 CVEs · 1 patches2026
11__init__src/datamodel_code_generator/parser/base.py2 CVEs · 1 patches2026
12_get_ref_body_from_remotesrc/datamodel_code_generator/parser/jsonschema.py1 CVEs · 1 patches2026
13_get_ref_body_from_urlsrc/datamodel_code_generator/parser/jsonschema.py1 CVEs · 1 patches2026
14_resolve_local_ref_pathsrc/datamodel_code_generator/parser/jsonschema.py1 CVEs · 1 patches2026
15get_field_extrassrc/datamodel_code_generator/parser/jsonschema.py1 CVEs · 1 patches2026

Most patched files

Files in koxudaxi/datamodel-code-generator changed by the most CVE fixes.

1src/datamodel_code_generator/parser/jsonschema.py7 CVEs · 16 functions
2src/datamodel_code_generator/http.py4 CVEs · 12 functions
3src/datamodel_code_generator/__main__.py2 CVEs · 3 functions
4src/datamodel_code_generator/model/base.py2 CVEs · 3 functions
5src/datamodel_code_generator/config.py2 CVEs · 2 functions
6src/datamodel_code_generator/parser/base.py2 CVEs · 2 functions
7src/datamodel_code_generator/arguments.py2 CVEs · 1 functions
8src/datamodel_code_generator/cli_options.py2 CVEs · 1 functions
9src/datamodel_code_generator/deprecations.py2 CVEs · 1 functions
10src/datamodel_code_generator/__init__.py2 CVEs · 1 functions

Fix size

How much code a CVE fix in koxudaxi/datamodel-code-generator changes, with backports counted once.

51

Median lines changed

Added plus removed, per CVE

38%

Fixes of 20 lines or fewer

Share of CVE fixes

8%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in koxudaxi/datamodel-code-generator, and the functions each fix changed.

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
CVE-2026-55389_resolve_local_ref_path _get_ref_body _get_ref_body_from_url
High · CVSS 7.5
EPSS 0.5%2026-07-28
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
CVE-2026-54653_validate_default_factory get_field_extras
High · CVSS 8.8
EPSS 0.7%2026-07-28
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
CVE-2026-55391_get_addr_info_ip _ResponseHeaders _validate_url_for_fetch
High · CVSS 7.5
EPSS 0.3%2026-07-28
`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
CVE-2026-54656validate_field format_validation_error _is_python_identifier
High · CVSS 7.8
EPSS 0.3%2026-07-28
datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
CVE-2026-54690get_body _get_ref_body Deprecation
High · CVSS 8.2
EPSS 0.4%2026-07-28
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
CVE-2026-55415and _validate_schema_python_import_path _get_x_python_import_path
High · CVSS 7.5
EPSS 0.5%2026-07-28
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
CVE-2026-54621comment_safe __init__
High · CVSS 7.8
EPSS 0.2%2026-07-28
`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
CVE-2026-54655is_python_type_annotation _get_x_python_type decorator
High · CVSS 7.8
EPSS 0.2%2026-07-28
datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
CVE-2026-55403_get_url_origin validates get_body
Low · CVSS 3.7
EPSS 0.3%2026-07-28
datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
CVE-2026-54691get_body _get_ref_body Deprecation
High · CVSS 8.2
EPSS 0.4%2026-07-28
Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
CVE-2026-55390_resolve_schema_location _collect_schema _detect_effective_xmlschema_version
High · CVSS 7.5
EPSS 0.5%2026-07-28
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
CVE-2026-54654inline_comment_safe render
High · CVSS 7.8
EPSS 0.2%2026-07-28

Get an alert for each new koxudaxi/datamodel-code-generator CVE, with the patched functions and AI-written analysis.

Monitor datamodel-code-generator CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/kylin13 CVEs apache/superset13 CVEs bagisto/bagisto13 CVEs better-auth/better-auth13 CVEs caddyserver/caddy13 CVEs cerebrate-project/cerebrate13 CVEs CoreWCF/CoreWCF13 CVEs craftcms/commerce13 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in koxudaxi/datamodel-code-generator.

How many CVEs have a located fix in koxudaxi/datamodel-code-generator?: 13 published CVEs have a fix traced to functions in koxudaxi/datamodel-code-generator, touching 54 functions across 18 files.
Which function in koxudaxi/datamodel-code-generator has been patched by the most CVEs?: _get_ref_body in src/datamodel_code_generator/parser/jsonschema.py has been changed by 3 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in koxudaxi/datamodel-code-generator?: The median fix changes 51 lines. 38% of fixes change 20 lines or fewer, and 8% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

koxudaxi/datamodel-code-generator on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track koxudaxi/datamodel-code-generator CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References