Skip to content
Threat Feed
Subscribe

Vendor

Koxudaxi

2 briefs RSS
high advisory

datamodel-code-generator Vulnerable to Arbitrary Local File Read via XSD Path Traversal

datamodel-code-generator versions 0.59.0 through 0.61.0 are vulnerable to an unauthenticated path traversal and information disclosure issue, allowing an attacker to read arbitrary local files on the system where the code generator is executed by crafting a malicious XML Schema (XSD) `schemaLocation` attribute, with the contents of the files then incorporated into the generated output.

datamodel-code-generator path-traversal information-disclosure supply-chain vulnerability
1t
high advisory

Datamodel Code Generator Vulnerable to SSRF via URL Parameter

The `datamodel-code-generator` tool, specifically versions from `0.9.1` up to `0.60.2`, is vulnerable to Server-Side Request Forgery (SSRF) when using the `--url` argument with the `[http]` extra installed, allowing attackers to access internal network resources and exfiltrate sensitive data into generated Python files.

datamodel-code-generator ssrf supply-chain code-generation python vulnerability
1r 3t 3i