CVE-2026-73851

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

PT-2026-76675

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

EUVD-2026-58550

A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack...

CVE-2026-19756

A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack...

CVE-2026-19756

The vulnerability CVE-2026-19756 affects Dromara lamp-cloud (Code Generator) in DefGenProjectController.java, where improper handling of outputDir/parent/projectPrefix enables path traversal. The issue allows remote exploitation with a Proof-of-Concept exploit disclosed publicly; impact and speci...

CVE-2026-19756 Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal

A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack...

CVE-2026-19756 Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal

A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack...

PT-2026-71927

Name of the Vulnerable Software and Affected Versions Dromara lamp-cloud versions prior to 5.10.1 Description A path traversal issue exists in the Code Generator component within the DefGenProjectController.java file. A remote attacker can exploit this by manipulating the outputDir, parent, or...

Code Injection

datamodel-code-generator is vulnerable to Code Injection. The vulnerability is due to insufficient validation of x-python-type values from attacker-controlled JSON Schema content before inserting them into generated Python field annotations, which allows an attacker to execute arbitrary Python co...

Sensitive Information Exposure

datamodel-code-generator is vulnerable to Sensitive Information Exposure. The vulnerability is due to the reuse of Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, which allows an attacker controlling a redirect target to...

Server-Side Request Forgery (SSRF)

datamodel-code-generator is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to http.getbody in src/datamodelcodegenerator/http.py accepting --url targets and redirect chain targets without proper host/IP validation, which allows an attacker to perform server-side request...

Path Traversal

datamodel-code-generator is vulnerable to Path Traversal. The vulnerability is due to improper validation of schemaLocation values in XML Schema parsing xs:include, xs:import, xs:redefine, and xs:override, which allows an attacker to reference files outside the intended input base path, resulting...

SUSE CVE-2026-55391

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

SUSE CVE-2026-55415

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...

SUSE CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-54654

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:44+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r 2026-07-29 03:28:01+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrqy7iat4v2y...

CVE-2026-55403

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:27+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2 2026-07-29 00:00:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqmmvyow724...

CVE-2026-54655

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:24+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q...

CVE-2026-55391

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:11+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-vx7x-vcc2-c44g 2026-07-28 23:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqjccj7di2u...