PT-2026-65607 · Pypi · Datamodel-Code-Generator

CVE-2026-55390 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.59.0 through 0.61.0

Description When generating Python data models from an XML Schema using the --input-file-type xmlschema option, the software improperly resolves schemaLocation values within <xs:include>, <xs:import>, <xs:redefine>, and <xs:override> elements. This occurs because the parser does not restrict the resolved path to the input base directory, allowing the use of absolute paths or directory traversal sequences like ../ to access arbitrary local files. If an attacker provides a malicious XSD, they can read local files and have the contents reflected in the generated models. This is an unauthenticated path-traversal and information-disclosure issue that remains active even when the --no-allow-remote-refs flag is used.

Recommendations Update datamodel-code-generator to version 0.62.0.

Fix

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

CWE-610

Related Identifiers

CVE-2026-55390

GHSA-442Q-2J6P-642G

Affected Products

Datamodel-Code-Generator

References · 6

• https://osv.dev/vulnerability/GHSA-442q-2j6p-642g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55390 · Security Note
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-442q-2j6p-642g · Note
• https://github.com/koxudaxi/datamodel-code-generator/commit/d2d5cecd9fd3a2a6dbf148bf0740b83a11fc6820 · Note
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0 · Note
• https://github.com/koxudaxi/datamodel-code-generator · Note