{"uuid": "a7858398-ed42-47f9-a6d9-19a4e553d337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8359-h9fx-j6v9", "type": "seen", "source": "https://gist.github.com/alon710/d0f3f961aeff39e79a8edafcd7786784", "content": "# CVE-2026-55389: CVE-2026-55389: Path Traversal and Security Control Bypass in datamodel-code-generator via Scheme Reference Resolution\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55389\n\n## Summary\nAn arbitrary local file read and path traversal bypass vulnerability in datamodel-code-generator before version 0.62.0 allows unauthenticated remote attackers to read arbitrary files via crafted JSON-Schema $ref references using the file:// scheme or directory traversal sequences.\n\n## TL;DR\nUnauthenticated path traversal and local file read vulnerability in datamodel-code-generator prior to 0.62.0 allowed attackers to bypass --no-allow-remote-refs using the file:// scheme or relative pathing, revealing host system file structure and secrets.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-55389\n- **Vulnerability Type**: Directory Traversal (CWE-22) / Security Control Bypass\n- **CVSS Base Score**: 7.5 (High)\n- **Attack Vector**: Network (AV:N)\n- **Affected Component**: jsonschema parser (jsonschema.py)\n- **Exploit Status**: Proof-of-Concept (PoC) documented\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- datamodel-code-generator\n- **datamodel-code-generator**: < 0.62.0 (Fixed in: `0.62.0`)\n\n## Mitigation\n\n- Upgrade to datamodel-code-generator version 0.62.0 or newer.\n- Enforce strict input validation on JSON schemas containing external $ref structures.\n- Disable parsing of untrusted user-supplied schemas in automated backend environments.\n\n**Remediation Steps:**\n1. Identify internal usages of datamodel-code-generator in dependency manifests (e.g., requirements.txt, pyproject.toml).\n2. Update the package pin to >=0.62.0.\n3. Test build pipelines to ensure schema configurations continue resolving trusted internal paths correctly.\n\n## References\n\n- [GitHub Security Advisory GHSA-8359-h9fx-j6v9](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9)\n- [Official Fix Commit on GitHub](https://github.com/koxudaxi/datamodel-code-generator/commit/2ff4a72b4550a2b2069754c5b075b1655067e5fb)\n- [PyPI Release Tag 0.62.0](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0)\n- [Project Repository](https://github.com/koxudaxi/datamodel-code-generator)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55389) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T10:31:22.400431Z"}