Vulnerabilities in koxudaxi
16 resultsCVE-2026-63720HIGHdatamodel-code-generator Code Injection via Unvalidated customBasePath Schema FieldEPSS 0.7%CVE-2026-54653HIGH`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema fieldEPSS 0.7%CVE-2026-55390HIGHArbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gateEPSS 0.6%CVE-2026-55389HIGHdatamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`EPSS 0.5%CVE-2026-55415HIGHdatamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statementsEPSS 0.5%CVE-2026-63470CRITICALfastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstringEPSS 0.5%CVE-2026-54690HIGHdatamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)EPSS 0.4%CVE-2026-55403LOWdatamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemasEPSS 0.3%CVE-2026-63469CRITICALfastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dictEPSS 0.3%CVE-2026-63471CRITICALfastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decoratorEPSS 0.3%CVE-2026-55391HIGHdatamodel-code-generator vulnerable to SSRF protection bypass via DNS rebindingEPSS 0.3%CVE-2026-54691HIGHdatamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirectsEPSS 0.3%CVE-2026-54656HIGH`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-dataEPSS 0.3%CVE-2026-54654HIGH`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` fieldEPSS 0.2%CVE-2026-54655HIGH`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generatorEPSS 0.2%CVE-2026-54621HIGH`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union descriptionEPSS 0.2%