CVE-2026-55390

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55390
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55390.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55390
Aliases
Published
2026-07-28T21:25:32Z
Modified
2026-09-11T11:46:58Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
Details

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-22",
        "CWE-610"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55390.json"
}
References

Affected packages

Git / github.com/datamodel-code-generator/datamodel-code-generator

Affected ranges

Type
GIT
Repo
https://github.com/datamodel-code-generator/datamodel-code-generator
Events
Introduced
4278b9c215dceef604573ab62fe0d51343670d07
Fixed
d2d5cecd9fd3a2a6dbf148bf0740b83a11fc6820
Fixed
00de1a3517b0c41eb478c6efbd58220aea249db1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.59.0"
        },
        {
            "fixed":  "0.62.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.59.0
0.59.1
0.60.0
0.60.1
0.60.2
0.61.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55390.json"