CVE-2026-63720-datamodel-code-generator

CVE-2026-63720: Code Injection in datamodel-code-generator via Unvalidated customBasePath Severity: High, CVSS 3.1 7.5 / CVSS 4.0 7.5 assigned by VulnCheck, the CNA Environmental ceiling network-service deployment: up to 9.8 Vector v4.0:...

datamodel-code-generator (>=0.1.0, <=0.2.16), fluxio-parser (0.1.0) +16 more potentially affected by CVE-2026-114134 +1 more via black (19.3.0b0)

black PYPI version 19.3.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - datamodel-code-generator =0.1.0, =0.1.13, =0.1.4, =0.0.0, =0.0.12, =0.1.4, =2019.7.20, =0.0.5, =0.0.18 - straitjacket 201904.10.0b0 and more Source...

python313-datamodel-code-generator-0.83.0-1.1 on GA media (moderate)

python313-datamodel-code-generator-0.83.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:12096-1 Rating: moderate Cross-References: CVE-2026-107377 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues...

agency-swarm (>=1.10.0, <=1.11.0), appai (1.0.1) +7 more potentially affected by CVE-2026-107377 via datamodel-code-generator (>=0.59.1, <=0.76.2)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =0.61.0, =0.7.0, =1.3.0, =0.1.1, =0.5.0, =0.1.0, =0.2.0 Source cves: CVE-2026-107377 Source advisory: OSV:PYSEC-2026-4205...

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

SummaryWhen processing an attacker-controlled Protobuf schema, vulnerable versions ofdatamodel-code-generator could write a generated weak-import stub outside theintended weakimports temporary directory. Absolute import paths and relativepaths containing .. could escape this directory.An attacker...

PYSEC-2026-4205 datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

Linux Distros Unpatched Vulnerability : CVE-2026-107377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply...

SUSE CVE-2026-55389

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in...

SUSE CVE-2026-55390

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

OPENSUSE-SU-2026:12096-1 python313-datamodel-code-generator-0.83.0-1.1 on GA media

These are all security issues fixed in the python313-datamodel-code-generator-0.83.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

UBUNTU-CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

GHSA-77XJ-X4RM-935C datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

agency-swarm (>=1.10.0, <=1.11.0), appai (1.0.1) +7 more potentially affected by CVE-2026-107377 via datamodel-code-generator (>=0.59.1, <=0.76.2)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =0.61.0, =0.7.0, =1.3.0, =0.1.1, =0.5.0, =0.1.0, =0.2.0 Source cves: CVE-2026-107377 Source advisory: OSV:GHSA-77XJ-X4RM-935C...

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

External Control of File Name or Path

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to External Control of File Name or Path via the writemissingweakimports method in src/datamodelcodegenerator/parser/protobuf.py when processing a Protocol Buffers schema file containi...

agency-swarm (>=1.10.0, <=1.11.0), appai (1.0.1) +7 more potentially affected by CVE-2026-107377 via datamodel-code-generator (>=0.59.1, <=0.76.2)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =0.61.0, =0.7.0, =1.3.0, =0.1.1, =0.5.0, =0.1.0, =0.2.0 Source cves: CVE-2026-107377 Source advisory: GHSA-77XJ-X4RM-935C...

agency-swarm (>=1.10.0, <=1.11.0), appai (1.0.1) +7 more potentially affected by CVE-2026-107377 via datamodel-code-generator (>=0.59.1, <=0.76.2)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =0.61.0, =0.7.0, =1.3.0, =0.1.1, =0.5.0, =0.1.0, =0.2.0 Source cves: CVE-2026-107377 Source advisory: SNYK:PYTHON-DATAMODELCODEGENERATOR-20574179...