Skip to content
Threat Feed
Subscribe

Product

Datamodel-Code-Generator (>= 0.59.0, <= 0.61.0)

1 brief RSS
high advisory

datamodel-code-generator Vulnerable to Arbitrary Local File Read via XSD Path Traversal

datamodel-code-generator versions 0.59.0 through 0.61.0 are vulnerable to an unauthenticated path traversal and information disclosure issue, allowing an attacker to read arbitrary local files on the system where the code generator is executed by crafting a malicious XML Schema (XSD) `schemaLocation` attribute, with the contents of the files then incorporated into the generated output.

datamodel-code-generator path-traversal information-disclosure supply-chain vulnerability
1t