PT-2026-65614 · Pypi · Datamodel-Code-Generator
CVE-2026-55389
·
Published
2026-07-28
·
Updated
2026-07-28
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
datamodel-code-generator versions prior to 0.62.0
Description
An unauthenticated path traversal and information disclosure issue exists when the software resolves JSON Schema
$ref targets. The application fails to restrict these targets to the input directory and does not honor the --no-allow-remote-refs security control when processing local files. This allows an attacker who controls an input schema to read arbitrary local files that the process user has permissions to access, effectively mapping the host filesystem.Technical details include:
- API Endpoints: The issue occurs during the processing of input schemas via the command-line interface or integrated services.
- Vulnerable Parameters or Variables: The
$refkey within a JSON Schema is used to trigger the traversal. - Function Names: The vulnerability is located in
src/datamodel code generator/parser/jsonschema.pywithin theis url()andget ref body()functions.
Exploitation can occur using a
file:// absolute URI or a ../ relative reference. If the referenced file is shaped like a JSON Schema, sensitive values in const, default, enum, or description fields may be emitted verbatim into the generated Python code. For unstructured files, the attacker can use the application as a filesystem oracle to determine if files exist or are readable based on the resulting error messages.Recommendations
Update datamodel-code-generator to version 0.62.0 or later.
Fix
Information Disclosure
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Datamodel-Code-Generator