EUVD-2026-50078
GHSA-8359-h9fx-j6v9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0.
AnalysisAI
We need to produce a JSON object with the specified fields. We'll synthesize data from the input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datamodel Code Generator
View allWe need to construct a JSON object that synthesizes data from multiple sources about CVE-2026-54690. The input includes
Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitr
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the defa
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value t
Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code
Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL sc
We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, referenc
Remote code execution in datamodel-code-generator prior to version 0.70.0 allows attackers who control input schemas to
Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows
Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today