The datamodel-code-generator tool, which generates Pydantic v2 models and other data structures from various schema formats, contains an SSRF vulnerability (CWE-918) in versions >=0.9.1 <0.61.0. The vulnerability arises because the tool silently dereferences JSON Schema $ref URLs over HTTP or HTTPS in the _get_ref_body function within jsonschema.py. The --allow-remote-refs option may only warn instead of blocking, enabling an attacker to cause the server to make unintended HTTP requests. This SSRF flaw is fixed in version 0.61.0.

An attacker can exploit this vulnerability to make the server perform unauthorized HTTP or HTTPS requests to arbitrary URLs. This can lead to information disclosure (high confidentiality impact) and potentially other indirect impacts. The CVSS score of 8.2 reflects a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial integrity impact without availability impact.

Upgrade datamodel-code-generator to version 0.61.0 or later, where this SSRF vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.