Koxudaxi - CraftedSignal Threat Feed

datamodel-code-generator Vulnerable to Arbitrary Local File Read via XSD Path Traversal

hello@craftedsignal.io — Tue, 28 Jul 2026 21:34:55 +0000

Versions 0.59.0 through 0.61.0 of datamodel-code-generator, a tool for generating data models, contain a high-severity path traversal vulnerability (CVE-2026-55390). When processing an attacker-controlled XML Schema Definition (XSD) file, the tool fails to properly sanitize schemaLocation attributes within , , , and elements. This allows an attacker to specify relative paths using ../ or absolute paths, enabling the datamodel-code-generator process to read arbitrary files outside the intended project directory. The contents of these external files are subsequently incorporated into the generated Python models, leading to information disclosure. The default configuration is affected, and existing --no-allow-remote-refs options do not mitigate this specific XSD-based vector, making it a significant risk for applications and CI pipelines that process untrusted XSD input.

Attack Chain

An attacker crafts a malicious XSD file containing an or element with a schemaLocation attribute.
The schemaLocation attribute is set to either a path traversal sequence (e.g., ../../etc/passwd) or an absolute path (e.g., /var/log/apache2/access.log).
The attacker convinces a victim to generate models using the malicious XSD file, for instance, by integrating it into a build pipeline or using it in a multi-tenant environment.
The victim executes datamodel-codegen --input attacker.xsd --input-file-type xmlschema --output generated_models.py.
During the XSD parsing process, datamodel-code-generator resolves the malicious schemaLocation.
Due to the vulnerability, the tool reads the content of the arbitrary local file specified in the schemaLocation.
The content of the sensitive file is then folded into the generated Python output file (generated_models.py).
The attacker subsequently obtains the generated output, thereby exfiltrating the contents of the sensitive local file.

Impact

This vulnerability (CVE-2026-55390) enables arbitrary local file read (CWE-22) leading to significant information disclosure (CWE-200). Any environment that uses datamodel-code-generator to process untrusted XML Schema Definition (XSD) files is at risk. This includes development workflows, CI/CD pipelines, and multi-tenant services where an attacker can supply an XSD. Attackers can read sensitive files such as configuration files, source code, private keys, or system credentials. While verbatim disclosure is guaranteed for XML/XSD-shaped data, the tool reads raw bytes of any file, making it a potent primitive for arbitrary file access. The compromised data, once incorporated into generated models, can be exfiltrated via various means, such as being committed to a repository, logged, or returned by a service.

Recommendation

Upgrade datamodel-code-generator to version 0.62.0 or newer immediately to address CVE-2026-55390.
Implement checks to reject resolved schemaLocation targets that are not strictly relative to the base path when processing XSD files in any custom integration.
Ensure that any automated systems or services processing untrusted XSD files run with the principle of least privilege, limiting their access to sensitive file system locations.

Datamodel Code Generator Vulnerable to SSRF via URL Parameter

hello@craftedsignal.io — Tue, 28 Jul 2026 21:34:03 +0000

Versions 0.9.1 through 0.60.2 of the datamodel-code-generator tool are susceptible to Server-Side Request Forgery (SSRF) when the optional [http] extra is installed. This vulnerability arises because the tool's built-in HTTP fetcher, utilized when the --url command-line argument is supplied, lacks critical validation for host and IP addresses and unconditionally follows HTTP redirects. An attacker can craft a malicious URL that redirects to internal network resources, loopback addresses, private IP ranges, or cloud metadata services like 169.254.169.254. If successfully exploited, the tool will fetch content from these internal destinations and embed any sensitive information (e.g., IAM credentials, internal API responses) directly into the generated .py source code. This poses a significant risk of internal network reconnaissance, sensitive data disclosure, and credential exfiltration, particularly if the generated files are committed to a public or attacker-accessible repository. Organizations using datamodel-code-generator should upgrade to version 0.61.0 or later to mitigate this risk.

Attack Chain

An attacker crafts a malicious external URL (e.g., https://attacker.com/schema.json) that issues an HTTP 302 redirect to an internal network resource, a private IP address, or a cloud metadata service (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/).
A victim executes the datamodel-code-generator tool, providing the attacker-controlled external URL via the --url command-line argument.
The datamodel-code-generator tool, specifically its http.get_body function, initiates an HTTP GET request to the provided external URL.
The external server responds with an HTTP 302 redirect to the internal target specified by the attacker.
Due to the follow_redirects=True setting and absence of host/IP validation, datamodel-code-generator transparently follows the redirect and fetches content from the sensitive internal resource, effectively bypassing network boundaries.
The response body from the internal resource (e.g., IAM role credentials, confidential internal API responses, or system information) is processed and interpreted as a schema.
Sensitive information extracted from this internal response body is subsequently embedded into the generated Python .py source file, for example, as docstrings, class attributes, or field descriptions.
The generated .py file, now containing the exfiltrated sensitive data, is potentially committed to a version control system, making the internal information accessible to the attacker or a wider audience.

Impact

This SSRF vulnerability can have significant consequences, primarily affecting organizations that use datamodel-code-generator with unverified URLs or within environments where internal services are accessible from development workstations or CI/CD pipelines. The observed damages include internal network reconnaissance through port scanning localhost or private IP ranges, and the disclosure of highly sensitive information. This can involve the exfiltration of cloud IAM credentials from metadata services (e.g., AWS EC2), internal API keys, or proprietary data from intranet applications. If the generated Python files containing this sensitive data are then committed to a repository, it constitutes a direct exfiltration channel, potentially granting attackers access to cloud infrastructure or other critical internal systems.

Recommendation

Upgrade datamodel-code-generator to version 0.61.0 or higher immediately to patch CVE-2026-54691.
Deploy the Detect datamodel-code-generator SSRF attempts to internal IPs Sigma rule to your SIEM to identify suspicious invocations of the tool targeting internal or private IP addresses.
Review existing codebases for datamodel-codegen invocations that use the --url parameter, especially in automated CI/CD pipelines, to ensure URLs are trusted and do not point to attacker-controlled domains or could redirect to internal resources.
Implement source code analysis tools to scan generated .py files for embedded sensitive information (e.g., API keys, credentials, private IPs) that may have resulted from past exploitation of this vulnerability.