What is the CVSS score of EUVD-2026-50068?

EUVD-2026-50068 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Python are affected by EUVD-2026-50068?

The datamodel-code-generator tool, used to automate model generation from XML schemas, contains a critical file read vulnerability (CVE-2026-55390) that lets an unauthenticated attacker with control…. A patch is available.

How to fix or mitigate EUVD-2026-50068?

Within 24 hours, upgrade all instances of datamodel-code-generator to version 0.62.0, which fixes the path traversal issue. Over the next 7 days, audit logs for any unusual file access patterns or unexpected model outputs that may indicate exploitation. Within 30 days, review and restrict the tool's file system permissions to limit the impact of any similar vulnerabilities and ensure all dependencies are up-to-date.

Python EUVD-2026-50068

| CVE-2026-55390 HIGH

Path Traversal (CWE-22)

2026-07-28 GitHub_M

GHSA-442q-2j6p-642g

Python Path Traversal Datamodel Code Generator Koxudaxi

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 28, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jul 28, 2026 - 21:51 vuln.today

Analysis Generated

Jul 28, 2026 - 21:51 vuln.today

CVE Published

Jul 28, 2026 - 21:25 cve.org

HIGH 7.5

DescriptionCVE.org

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0.

Articles & Coverage 2

News 11 New Python Vulnerabilities - 0 Critical, 11 High Jul 29, 2026 News 11 New Python Vulnerabilities - 0 Critical, 11 High Jul 28, 2026

AnalysisAI

Arbitrary local file read in datamodel-code-generator versions 0.59.0 to 0.61.0 via path traversal in XSD parsing allows unauthenticated attackers who control an input XML Schema to read any file readable by the generator process, with the contents reflected into generated models. A public proof-of-concept exploit exists, and the issue is fixed in version 0.62.0.