{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/datamodel-code-generator--0.61.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["datamodel-code-generator \u003c= 0.61.0"],"_cs_severities":["high"],"_cs_tags":["vulnerability","path-traversal","information-disclosure","python"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA high-severity arbitrary local file read vulnerability (CVE-2026-55389) has been discovered in \u003ccode\u003edatamodel-code-generator\u003c/code\u003e versions 0.61.0 and earlier. This Python library is commonly used in development workflows, CI/CD pipelines, and multi-tenant services to generate data models from OpenAPI or JSON-Schema specifications. The vulnerability allows an attacker to craft a malicious JSON-Schema containing \u003ccode\u003e$ref\u003c/code\u003e fields that reference arbitrary local files on the system running the generator. This can be achieved using \u003ccode\u003efile://\u003c/code\u003e URIs for absolute paths or \u003ccode\u003e../\u003c/code\u003e sequences for relative path traversal, effectively bypassing the \u003ccode\u003e--no-allow-remote-refs\u003c/code\u003e security control. Successful exploitation leads to unauthorized information disclosure, including sensitive data like \u003ccode\u003e/etc/passwd\u003c/code\u003e, private keys (e.g., \u003ccode\u003eid_rsa\u003c/code\u003e), configuration files, and allows mapping of the host's filesystem layout. The fix was released in version 0.62.0, which applies the remote-ref gate to \u003ccode\u003efile://\u003c/code\u003e references and local JSON Schema refs outside the input base path.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eAttacker crafts malicious JSON-Schema:\u003c/strong\u003e An attacker creates a JSON-Schema file (e.g., \u003ccode\u003eprobe.json\u003c/code\u003e) containing a \u003ccode\u003e$ref\u003c/code\u003e field with a crafted URI.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReferences sensitive local files:\u003c/strong\u003e The \u003ccode\u003e$ref\u003c/code\u003e field uses a \u003ccode\u003efile://\u003c/code\u003e scheme to point to an absolute path (e.g., \u003ccode\u003efile:///etc/passwd\u003c/code\u003e) or \u003ccode\u003e../\u003c/code\u003e path traversal sequences (e.g., \u003ccode\u003e../.ssh/id_rsa\u003c/code\u003e) to reference arbitrary local files.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVictim executes \u003ccode\u003edatamodel-code-generator\u003c/code\u003e:\u003c/strong\u003e A victim's system, such as a CI/CD pipeline, development environment, or multi-tenant service, invokes the \u003ccode\u003edatamodel-code-generator\u003c/code\u003e utility to process the attacker's untrusted schema (e.g., \u003ccode\u003edatamodel-codegen --input probe.json --output o.py\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerable reference resolution:\u003c/strong\u003e \u003ccode\u003edatamodel-code-generator\u003c/code\u003e's internal logic, specifically within the \u003ccode\u003e_get_ref_body\u003c/code\u003e function, attempts to resolve the \u003ccode\u003e$ref\u003c/code\u003e target.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBypasses security control:\u003c/strong\u003e The vulnerability allows the \u003ccode\u003efile://\u003c/code\u003e scheme to be explicitly exempted from the \u003ccode\u003eallow_remote_refs\u003c/code\u003e check, or for relative paths, the \u003ccode\u003eis_relative_to(base_path)\u003c/code\u003e check is not enforced, allowing traversal outside the base directory.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary file read:\u003c/strong\u003e The vulnerable code path (\u003ccode\u003e_get_ref_body_from_url\u003c/code\u003e or \u003ccode\u003e_get_ref_body_from_remote\u003c/code\u003e) proceeds to load the content of the arbitrary local file referenced in the \u003ccode\u003e$ref\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFilesystem oracle and information disclosure:\u003c/strong\u003e Depending on the target file's content and permissions, the tool either generates an error message (e.g., \u0026quot;TypeError: Expected dict, got str\u0026quot;) indicating the file was read and parsed, or directly incorporates schema-shaped secrets (e.g., from \u003ccode\u003econst\u003c/code\u003e/\u003ccode\u003edefault\u003c/code\u003e/\u003ccode\u003eenum\u003c/code\u003e/\u003ccode\u003edescription\u003c/code\u003e fields) from the read file into the generated Python code.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExfiltration via generated code or errors:\u003c/strong\u003e The attacker receives the generated Python code (if it contains secrets) or observes the process's error messages (providing an oracle for file existence and permissions), thereby exfiltrating sensitive information or mapping the victim's filesystem layout.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability leads to arbitrary local file read (CWE-22) and subsequent information disclosure (CWE-200), bypassing a documented security control (\u003ccode\u003e--no-allow-remote-refs\u003c/code\u003e). Any application, CI pipeline, or multi-tenant service running \u003ccode\u003edatamodel-code-generator\u003c/code\u003e on untrusted schemas is at risk. Attackers can read any file accessible to the process user, including sensitive system files like \u003ccode\u003e/etc/passwd\u003c/code\u003e, private keys (e.g., PEM \u003ccode\u003eid_rsa\u003c/code\u003e), and configuration files (e.g., service-account JSON, Kubernetes secret manifests). This allows for host filesystem mapping by probing arbitrary paths and exfiltrating secret values verbatim if they are embedded within schema-shaped nodes. The issue does not require authentication or special privileges, making it a critical threat for environments processing untrusted input.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003epip/datamodel-code-generator\u003c/code\u003e to version \u003ccode\u003e0.62.0\u003c/code\u003e or higher to remediate CVE-2026-55389.\u003c/li\u003e\n\u003cli\u003eEnsure the \u003ccode\u003e--no-allow-remote-refs\u003c/code\u003e flag is enabled when invoking \u003ccode\u003edatamodel-code-generator\u003c/code\u003e with untrusted input, as this flag's bypass for \u003ccode\u003efile://\u003c/code\u003e references was fixed in version \u003ccode\u003e0.62.0\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRestrict execution permissions for \u003ccode\u003edatamodel-code-generator\u003c/code\u003e processes to the minimum necessary files and directories to limit potential damage from exploitation.\u003c/li\u003e\n\u003cli\u003eBlock the proof-of-concept URL \u003ccode\u003ehttps://gist.github.com/thegr1ffyn/2a87e81f985883acc30d0118c52da4d3\u003c/code\u003e at network perimeters to prevent access to known exploit code.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T21:53:14Z","date_published":"2026-07-28T21:53:14Z","id":"https://feed.craftedsignal.io/briefs/2026-07-datamodel-code-generator-file-read/","summary":"The `datamodel-code-generator` library (versions \u003c= 0.61.0) is vulnerable to an unauthenticated path traversal and arbitrary local file read (CVE-2026-55389), allowing an attacker to supply a crafted JSON-Schema with `$ref` fields pointing to local files using `file://` URIs or `../` path traversal sequences, bypassing the `--no-allow-remote-refs` security control, which leads to information disclosure of sensitive data and enables filesystem mapping.","title":"datamodel-code-generator Arbitrary Local File Read Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-datamodel-code-generator-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Datamodel-Code-Generator \u003c= 0.61.0","version":"https://jsonfeed.org/version/1.1"}