The datamodel-code-generator library is affected by a critical Server-Side Request Forgery vulnerability that could allow unauthenticated attackers to perform unauthorized requests.

This is a Server-Side Request Forgery (CWE-918) vulnerability. The flaw exists in how the library handles schema definitions, allowing an unauthenticated attacker to force the application to make arbitrary outbound requests.

Successful exploitation allows an attacker to interact with internal services that are otherwise protected from the public internet. This can lead to sensitive information disclosure or the bypass of network access controls. With a CVSS score of 8.2, this vulnerability represents a high risk to environment security.

Immediate Action: Update the datamodel-code-generator library to version 0.61.0 or later immediately.

Proactive Monitoring: Review application logs for unusual outbound network traffic originating from the server where the library is utilized.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal or unauthorized external endpoints.

Public Exploit Available: No confirmed public exploit available.

The risk posed by SSRF in code generation tools is significant, as it can be leveraged to probe internal infrastructure. Organizations using datamodel-code-generator must prioritize upgrading to version 0.61.0 to eliminate this vulnerability.