agency-swarm (>=1.10.0, <=1.10.1), fastapi-code-generator (0.7.0) potentially affected by CVE-2026-55390 via datamodel-code-generator (>=0.59.1, <=0.61.0)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =1.10.1 - fastapi-code-generator 0.7.0 Source cves: CVE-2026-55390 Source advisory: OSV:GHSA-442Q-2J6P-642G...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +138 more potentially affected by CVE-2026-55390 via datamodel-code-generator (>=0.5.10, <=0.61.0)

datamodel-code-generator PYPI version =0.5.10, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-55390 Source advisory: SNYK:PYTHON-DATAMODELCODEGENERATOR-18388115...

agency-swarm (>=1.10.0, <=1.10.1), fastapi-code-generator (0.7.0) potentially affected by CVE-2026-55390 via datamodel-code-generator (>=0.59.1, <=0.61.0)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =1.10.1 - fastapi-code-generator 0.7.0 Source cves: CVE-2026-55390 Source advisory: GHSA-442Q-2J6P-642G...

Directory Traversal

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Directory Traversal via the schemaLocation attribute in XSD processing. An attacker can access arbitrary files on the local filesystem by supplying a crafted XML Schema file that us...

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

Summary When generating models from an XML Schema --input-file-type xmlschema, datamodel-code-generator resolves , , , and schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read...

EUVD-2026-50068

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-55390 Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

agency-swarm (>=1.10.0, <=1.10.1), fastapi-code-generator (0.7.0) potentially affected by CVE-2026-55390 via datamodel-code-generator (>=0.59.1, <=0.61.0)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =1.10.1 - fastapi-code-generator 0.7.0 Source cves: CVE-2026-55390 Source advisory: MEND:CVE-2026-55390...

CVE-2026-55390

The CVE affects datamodel-code-generator where XML Schema parsing (src/datamodel_code_generator/parser/xmlschema.py) for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be...

CVE-2026-55390 Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-55390 Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-54654

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

EUVD-2026-50067

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

CVE-2026-54654

CVE-2026-54654 affects datamodel-code-generator (versions 0.14.1–0.60.2). The --extra-template-data comment field is rendered into Python comments in multiple templates without neutralizing carriage returns, allowing attacker-controlled comments to inject Python code into generated models that ex...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +127 more potentially affected by CVE-2026-54654 via datamodel-code-generator (>=0.14.1, <=0.59.1)

datamodel-code-generator PYPI version =0.14.1, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.1.0, =0.6.0 and more Source cves: CVE-2026-54654 Source advisory: MEND:CVE-2026-54654...

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

PT-2026-65609

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.17.0 through 0.60.1 Description Code injection is possible when generating Python models from attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schemas. The issue occurs because th...

PT-2026-65616

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0 Description When fetching remote schemas, the software re-sends original request headers to redirect targets even if the redirect changes the origin host, port, or scheme. This occurs within th...