What is the CVSS score of EUVD-2026-50078?

EUVD-2026-50078 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of datamodel-code-generator are affected by EUVD-2026-50078?

A high-severity file-disclosure flaw in the Python tool datamodel-code-generator (versions before 0.62.0) allows anyone who can supply a schema to that tool to read any file the code-generation…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-50078?

Yes, a public proof-of-concept exploit is available for EUVD-2026-50078. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-50078?

Within 24 hours, inventory every environment, pipeline, and service that runs datamodel-code-generator and determine which of them accept schema or OpenAPI input from outside the organization; for any such instance, disable external schema submission or isolate the job until it is upgraded. Within 7 days, upgrade datamodel-code-generator to 0.62.0 or later (Vendor-released patch: 0.62.0) across CI runners, container images, and hosted services, and verify the upgrade by confirming the installed package version in each build image and locking it in dependency manifests. Within 30 days, re-run the discovery to catch any newly introduced or forgotten consumers of the tool, restrict code-generation jobs to least-privilege credentials and mounted secrets so a file read yields minimal data, add schema-input validation and sandboxing controls to any customer-facing codegen service, and consider blocking file:// and ../ reference targets in input validation as a defense-in-depth measure.

datamodel-code-generator EUVD-2026-50078

| CVE-2026-55389 HIGH

Path Traversal (CWE-22)

2026-07-28 GitHub_M

GHSA-8359-h9fx-j6v9

Path Traversal Datamodel Code Generator

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Worst-case networked codegen service processes attacker schema unauthenticated with no interaction (AV:N/PR:N/UI:N); arbitrary local file read gives C:H, no integrity/availability impact; local CLI use would instead be AV:L/UI:R.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 28, 2026 - 23:02 EUVD

Source Code Evidence Fetched

Jul 28, 2026 - 22:21 vuln.today

Analysis Generated

Jul 28, 2026 - 22:21 vuln.today

CVE Published

Jul 28, 2026 - 21:49 cve.org

HIGH 7.5

DescriptionCVE.org

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0.

AnalysisAI

Arbitrary local file read in datamodel-code-generator before 0.62.0 lets unauthenticated attackers who control or can submit a JSON-Schema/OpenAPI input exfiltrate any file readable by the codegen process, because JSON-Schema $ref targets using a file:// URI or a ../ traversal are resolved without containment and even bypass the documented --no-allow-remote-refs control. Exploitation requires the tool to be run against an attacker-supplied schema (for example a hosted 'paste your schema' service, a CI job generating models from submitted specs, or a multi-tenant codegen platform); a local developer running the CLI only on their own schemas has no untrusted-input path and is not remotely triggerable. Publicly available exploit code exists (a public gist, tracked by SSVC as Exploitation: PoC and Automatable: yes), but the issue is not in CISA KEV and EPSS is low at 0.36% (29th percentile), so mass exploitation has not been observed.

Technical ContextAI

datamodel-code-generator is a Python codegen tool (distributed as pip package datamodel-code-generator, CPE cpe:2.3:a:koxudaxi:datamodel-code-generator) that turns OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON/YAML/CSV into Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct. The root cause is CWE-22 (Path Traversal) in src/datamodel_code_generator/parser/jsonschema.py: the helper is_url() classifies references beginning with https://, http:// or file:// as URLs, and _get_ref_body() then explicitly exempts file:// from the remote-reference gate ('if not resolved_ref.startswith("file://") ... if self.allow_remote_refs is False: raise Error'), so --no-allow-remote-refs never applies to file:// refs. The file:// branch (_get_ref_body_from_url) converts the URI path with url2pathname(urlparse(ref).path) and passes it straight to load_data_from_path() with no check that it stays within the input base path, and the plain relative branch (_get_ref_body_from_remote) computes full_path = self.base_path / resolved_ref without any Path.is_relative_to(base_path) validation, letting ../ escape the input directory. By contrast, the HTTP-local-ref branch (_get_ref_body_from_local_http_path) does enforce is_relative_to(base_path), confirming the omission is a gap in the filesystem branches rather than an intentional design choice. This is a local-filesystem disclosure issue distinct from the previously hardened HTTP $ref/--url SSRF in http.py; read scope is bounded by the OS permissions of the process user. The 0.62.0 fix introduces a _resolve_local_ref_path() helper that resolves the candidate path, permits it when it is relative to the input base path or when allow_remote_refs is True, emits a FutureWarning and still resolves when allow_remote_refs is None (default), and raises an Error ('Blocked unsafe local $ref') when --no-allow-remote-refs is explicitly set.

RemediationAI

Vendor-released patch: 0.62.0 - upgrade the pip package to datamodel-code-generator 0.62.0 or later (https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0), which contains the fix commit 2ff4a72b4550a2b2069754c5b075b1655067e5fb adding the _resolve_local_ref_path() containment check. Upgrading alone is not sufficient for untrusted-input deployments: in 0.62.0 the default behavior (allow_remote_refs unset) only warns and still resolves out-of-base references, so operators processing submitted schemas must also pass --no-allow-remote-refs, which turns such $refs into a hard 'Blocked unsafe local $ref' error; the trade-off is that this also rejects legitimate external HTTP(S) and local schema references, which then must be relocated under the input directory (or the flag replaced with an explicit --allow-remote-refs for trusted inputs, accepting the risk). For pre-patch environments where upgrading is not yet possible, the effective compensating control is isolation rather than a flag: run codegen in a container or sandbox with a read-only, minimal filesystem view containing only the schema and its intended dependencies, run the process as a low-privilege user with no access to secrets/customer data, and disable or gate any feature that accepts external schema submissions; do not rely on --no-allow-remote-refs before 0.62.0 because file:// and ../ refs bypass it entirely. Where user-supplied schemas must be accepted, pre-validate or strip $ref values that use the file:// scheme or contain ../ before invocation. Additional advisory context is at https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9.