Is CVE-2026-55403 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55403 being exploited in the wild.

How severe is CVE-2026-55403?

Low severity, with a CVSS score of 3.7, published 28 July 2026.

Which products and versions are affected?

Koxudaxi Datamodel-Code-Generator <= 0.62.0; datamodel-code-generator (PyPI) ECOSYSTEM:introduced=0,fixed=0.63.0.

Is there a fix for CVE-2026-55403?

Yes. datamodel-code-generator (PyPI): upgrade to 0.63.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55403 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55403?

Check whether you run Koxudaxi Datamodel-Code-Generator or datamodel-code-generator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55403: koxudaxi datamodel-code-generator credential leak in cross-origin redirects

Q: Is there a fix for CVE-2026-55403?

Yes. datamodel-code-generator (PyPI): upgrade to 0.63.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55403 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55403?

Check whether you run Koxudaxi Datamodel-Code-Generator or datamodel-code-generator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55403 · Severity: low · CVSS 3.7 · Published 2026-07-28

datamodel-code-generator is a tool used to automatically create Python code from data schema definitions. A security flaw was identified where the tool incorrectly shares sensitive login credentials (such as passwords or session tokens) when it is redirected from a trusted website to a different, potentially malicious website while downloading a schema. This could allow an attacker who controls a schema host to steal credentials intended for a legitimate service.

Technologies: Koxudaxi Datamodel-Code-Generator, datamodel-code-generator (PyPI). Vendors: Koxudaxi, PyPI.

Quick answers

Is CVE-2026-55403 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55403 being exploited in the wild.
How severe is CVE-2026-55403?: Low severity, with a CVSS score of 3.7, published 28 July 2026.
Which products and versions are affected?: Koxudaxi Datamodel-Code-Generator <= 0.62.0; datamodel-code-generator (PyPI) ECOSYSTEM:introduced=0,fixed=0.63.0.
Is there a fix for CVE-2026-55403?: Yes. datamodel-code-generator (PyPI): upgrade to 0.63.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55403 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55403?: Check whether you run Koxudaxi Datamodel-Code-Generator or datamodel-code-generator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

datamodel-code-generator (PyPI): upgrade to 0.63.0 or later
```
pip install "datamodel-code-generator>=0.63.0"
```

Technical details

A credential leakage vulnerability exists in the `get_body()` function within `src/datamodel_code_generator/http.py`. The component manually handles HTTP redirects but fails to strip sensitive headers when the redirect target belongs to a different origin (scheme, host, or port). An attacker who can influence the redirect chain—either by compromising a schema host or through an open redirect—can capture `Authorization`, `Cookie`, and `Proxy-Authorization` headers. This occurs when users provide credentials via `--http-headers` or URL userinfo. The issue is resolved in version 0.63.0 by ensuring sensitive headers are dropped during cross-origin redirects.

Affected products

koxudaxi datamodel-code-generator <= 0.62.0

Identifiers

CVE-2026-55403
GHSA-r5vv-ff45-prp2
PYSEC-2026-3563

Timeline

2026-06-11: patched: Fix merged into main branch
2026-06-12: advisory: GitHub Security Advisory GHSA-r5vv-ff45-prp2 published
2026-07-28: disclosed: CVE-2026-55403 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.