CVE-2026-55390: 
Python vulnerability analysis and mitigation

CVE-2026-55390 is a path traversal vulnerability in datamodel-code-generator, a Python tool that generates data models from schema definitions. When processing XML Schema files (--input-file-type xmlschema), the tool resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation attributes without restricting resolution to the input base directory, allowing arbitrary local files to be read and reflected into generated model output. Affected versions are >= 0.59.0 and <= 0.61.0 (XML Schema support was introduced in 0.59.0); the issue is fixed in version 0.62.0. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Feedly).

The root cause is improper path containment in src/datamodel_code_generator/parser/xmlschema.py (CWE-22, CWE-200, CWE-610). The vulnerable code resolves schemaLocation values using (source_dir / schema_location).resolve(), which normalizes ../ sequences and accepts absolute paths, but performs only an is_file() check — there is no is_relative_to(base_path) guard to confine resolution to the input directory. An attacker who controls the input XSD file can supply relative traversal paths (e.g., ../../etc/passwd) or absolute paths as schemaLocation values; the tool reads the target file and folds its XML/XSD-shaped content (type names, restrictions, enumerations) into the generated Python module. Critically, the --no-allow-remote-refs flag does not mitigate this issue because no equivalent remote-ref gate existed for XSD processing. A public PoC reproducer is available at https://gist.github.com/thegr1ffyn/c7096b797926348875d888652867eeb4 (Github Advisory, Fix Commit).

Successful exploitation results in arbitrary local file read and information disclosure (high confidentiality impact; no integrity or availability impact). Any application, CI/CD pipeline, or multi-tenant service that generates models from attacker-supplied XSD files and then exposes, logs, commits, or renders the generated code is at risk of leaking sensitive file contents such as configuration files, other schemas, or secrets accessible to the process. Verbatim disclosure is limited to files that are valid XML/XSD; raw binary files are read into the process but not echoed verbatim due to parse failure. No authentication or special privileges are required for exploitation (Github Advisory).

1. Identify a target: Locate an application, CI pipeline, or service that runs datamodel-codegen with --input-file-type xmlschema on versions >= 0.59.0 and <= 0.61.0, and where the attacker can supply or influence the input XSD file.
2. Craft a malicious XSD: Create an attacker-controlled XSD file (attack.xsd) that includes a schemaLocation attribute pointing to a target file outside the input directory using relative traversal (e.g., <xs:include schemaLocation="../../etc/passwd"/>) or an absolute path (e.g., schemaLocation="/etc/shadow").
3. Prepare a target file (if testing): Optionally place a valid XSD-shaped file at the traversal target path to ensure its content is parsed and reflected (e.g., a schema with distinctive type names or enumeration values).
4. Trigger code generation: Submit the malicious attack.xsd to the vulnerable tool: datamodel-codegen --input attack.xsd --input-file-type xmlschema --output out.py.
5. Retrieve disclosed content: Inspect the generated out.py output — type names, restrictions, and enumeration values from the referenced out-of-tree file will be reflected in the generated Python model, disclosing their contents to the attacker (Github Advisory).

• File System: Unexpected or anomalous generated Python model files containing type names, enumerations, or string values that correspond to sensitive configuration files or schemas outside the project directory.
• Logs: CI/CD pipeline logs showing datamodel-codegen invocations with --input-file-type xmlschema processing XSD files from untrusted or external sources; error messages containing "Blocked unsafe XML Schema schemaLocation" (present only in patched version 0.62.0, indicating a blocked attempt).
• Process: datamodel-codegen process reading files outside the designated input directory, observable via file access auditing tools (e.g., auditd, strace, or eBPF-based monitoring) (Github Advisory).

Upgrade datamodel-code-generator to version 0.62.0 or later, which introduces a _resolve_schema_location() method that rejects any schemaLocation resolving outside the input base path, raising an unconditional error for both relative traversal and absolute path references (Release 0.62.0, Fix Commit). As a workaround prior to patching, restrict datamodel-codegen to processing only XSD files from fully trusted sources, and sandbox the code generation process to limit file system access. Note that --no-allow-remote-refs does not mitigate this vulnerability (Github Advisory).

The vulnerability was reported by security researcher Hamza Haroon (thegr1ffyn) and confirmed by the maintainer (koxudaxi), who merged a private fix PR and released version 0.62.0. The advisory was published to the GitHub Advisory Database on July 28, 2026, and picked up by automated vulnerability feeds including ENISA EUVD, VulDB, and Tenable container security plugins shortly after disclosure (Github Advisory, Release 0.62.0).