datamodel-code-generator EUVD-2026-50078

Exploitation requires that the target runs datamodel-code-generator (< 0.62.0) on a JSON-Schema (or OpenAPI/other schema) input that the ATTACKER controls or can submit - e.g. a hosted 'paste your schema' codegen endpoint, a CI job generating models from user-submitted specs, or a multi-tenant codegen platform. The malicious schema must contain a $ref using either a file:// absolute URI or a ../-based relative path escaping the input base directory. Notably, the --no-allow-remote-refs security control does NOT limit this because is_url() exempts file:// from the remote-ref gate and the plain-relative branch performs no is_relative_to(base_path) check. The key LIMITING factor is trust of the input: if the tool is only ever run against schemas authored by the operator (typical local developer CLI workflow), there is no untrusted-input path and the flaw is not remotely triggerable. Read access is bounded by the OS permissions of the process user.

This is a genuine but moderate-priority information-disclosure issue, and the signals are internally consistent rather than conflicting. The vendor CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) captures the worst realistic case: a multi-tenant or 'paste-your-OpenAPI-schema' codegen service, or a CI job that generates models from attacker-submitted specs, where a malicious JSON-Schema $ref reaches the parser over the network with no authentication. SSVC (Exploitation: poc, Automatable: yes, Technical Impact: partial) aligns with this - a POC exists (public gist), exploitation is scriptable, but impact is partial (arbitrary local file READ only; no integrity or availability impact, no code execution). EPSS is low at 0.36% (29th percentile) and there is NO CISA KEV listing, so despite public POC availability there is no evidence of active exploitation - POC availability and active exploitation are distinct, and here only the former is present. The confidentiality rating C:H is well-justified since the flaw reads any file the process user can access (secrets, tokens, /etc/passwd, source). One nuance defenders should weigh: the AV:N rating only holds in networked/service deployments - for the common case of a developer running the CLI locally against their own trusted schema, the realistic vector is local with user interaction (AV:L/UI:R), which materially lowers exposure. Net: real, worth patching promptly on any service that ingests untrusted schemas, but not a drop-everything emergency for typical local CLI usage.

An attacker submits a crafted OpenAPI/JSON-Schema to a hosted codegen service, CI pipeline, or multi-tenant platform that runs datamodel-code-generator on untrusted input. The schema contains a $ref pointing to 'file:///etc/passwd' (absolute) or '../../secret/config.json' (relative traversal), which the parser resolves and reads with no containment check, embedding the file contents into generated output or error surfaces. A public POC exists (gist by alon710), and because the flaw bypasses even the --no-allow-remote-refs control, no special hardening short of upgrading blocks it.