CVE-2026-55389: 
Python vulnerability analysis and mitigation

CVE-2026-55389 is a path traversal and arbitrary local file read vulnerability in datamodel-code-generator, a Python tool that generates Pydantic v2 models, dataclasses, TypedDict, and other data models from OpenAPI, JSON Schema, and related formats. All versions up to and including 0.61.0 are affected; the issue was fixed in version 0.62.0. The vulnerability was discovered and reported by Hamza Haroon (thegr1ffyn), privately disclosed to the maintainer on June 12, 2026, and published to the GitHub Advisory Database on July 28, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, GHSA Security Advisory).

The root cause is improper path containment in src/datamodel_code_generator/parser/jsonschema.py when resolving JSON Schema $ref targets (CWE-22, CWE-200, CWE-610). Two distinct code paths are vulnerable: (1) _get_ref_body_from_url handles file:// URIs by converting them to absolute filesystem paths via url2pathname(urlparse(ref).path) with no check that the resolved path is within the input base directory; (2) _get_ref_body_from_remote constructs a full path as self.base_path / resolved_ref without verifying the result is relative to base_path, allowing ../ traversal to escape the intended directory. Critically, the is_url() function classifies file:// as a URL, but the --no-allow-remote-refs security gate explicitly exempted file:// URIs, meaning the documented security control was entirely bypassed for local file references. By contrast, the HTTP local-ref branch (_get_ref_body_from_local_http_path) correctly enforced is_relative_to(base_path), making the omission in the filesystem branches a clear oversight. A self-contained public PoC reproducer is available at https://gist.github.com/thegr1ffyn/2a87e81f985883acc30d0118c52da4d3 (GHSA Security Advisory).

An unauthenticated attacker who can supply a malicious JSON Schema to a vulnerable datamodel-code-generator instance can read any file accessible to the process user on the host filesystem, including sensitive files such as /etc/passwd, private keys, Kubernetes secret manifests, and service account credentials. When the referenced file is JSON-Schema-shaped, its const, default, enum, and description field values are emitted verbatim into the generated Python code returned to the attacker, enabling direct secret exfiltration. Additionally, the three distinguishable error outcomes (file read, file not found, permission denied) function as a filesystem oracle, allowing an attacker to enumerate the host's directory structure and recover absolute paths. Integrity and availability are not directly impacted, but the confidentiality impact is rated High (GitHub Advisory).

1. Identify a target: Locate a service, CI pipeline, or multi-tenant platform that accepts user-supplied OpenAPI or JSON Schema input and runs datamodel-code-generator (versions ≤ 0.61.0) on it, returning or logging the generated output.
2. Craft a malicious schema (absolute path via file://): Create a JSON Schema with a $ref pointing to a target file using a file:// URI, e.g.:

{"type":"object","properties":{"x":{"$ref":"file:///etc/passwd"}}}

3. Craft a malicious schema (relative path traversal): Alternatively, use ../ sequences to escape the base directory:

{"type":"object","properties":{"x":{"$ref":"../../../etc/shadow"}}}

4. Submit the schema: Provide the crafted schema as input to the vulnerable datamodel-codegen invocation (e.g., via a web form, API endpoint, or CI job trigger).
5. Interpret the response: Observe the error or generated output — a TypeError: Expected dict, got str confirms the file was opened and parsed; FileNotFoundError indicates the path does not exist; PermissionError indicates the file exists but is unreadable. Use these signals to enumerate the filesystem.
6. Exfiltrate secrets: For schema-shaped target files (e.g., internal OpenAPI specs, config files with default/const fields, k8s secret manifests), the values are emitted verbatim into the generated Python code, directly disclosing credentials, tokens, or internal hostnames (GHSA Security Advisory).

• Logs: Invocations of datamodel-codegen or datamodel-code-generator with input schemas containing $ref values starting with file:// or containing ../ sequences; error messages such as TypeError: Expected dict, got str, FileNotFoundError, or PermissionError in application or CI logs referencing unexpected filesystem paths.
• File System: Unexpected or anomalous input schema files (.json, .yaml) in temporary directories containing $ref values pointing to sensitive system paths (e.g., /etc/passwd, /root/, /proc/, PEM key paths).
• Process: datamodel-codegen process opening file descriptors to paths outside the expected input directory, observable via lsof or auditd file access logs; child processes or file reads targeting /etc/, /root/, /home/, or credential store paths.
• Network: In CI/CD or SaaS contexts, generated output files or logs transmitted externally containing verbatim values from internal configuration files (e.g., API tokens, internal hostnames, service account JSON keys) (GHSA Security Advisory).

Upgrade datamodel-code-generator to version 0.62.0 or later, which applies the remote-ref gate to file:// URIs and blocks relative $ref references that resolve outside the input base path when --no-allow-remote-refs is set. In 0.62.0, the default behavior emits a FutureWarning for out-of-tree local refs (for backward compatibility), and users who intentionally rely on trusted external local refs can pass --allow-remote-refs explicitly. Until patching is possible: restrict schema inputs to trusted sources only, run the codegen process under a least-privilege account with minimal filesystem access, and consider sandboxing the process (e.g., in a container with a read-only filesystem). Do not rely on --no-allow-remote-refs as a security control on versions ≤ 0.61.0, as it is bypassed by this vulnerability (GHSA Security Advisory, Release 0.62.0).

The vulnerability was confirmed by the maintainer (koxudaxi) following private disclosure, with a fix merged and released in version 0.62.0. The advisory credits Hamza Haroon (thegr1ffyn) as the reporter. No significant broader media coverage or notable community commentary beyond the GitHub advisory and standard vulnerability database aggregation has been observed at this time (GHSA Security Advisory).