CVE-2026-55389

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:06+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9 2026-07-28 23:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqjbutsj42m...

CVE-2026-55389 datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in...