CVE-2026-63720-datamodel-code-generator

CVE-2026-63720: Code Injection in datamodel-code-generator via Unvalidated customBasePath Severity: High, CVSS 3.1 7.5 / CVSS 4.0 7.5 assigned by VulnCheck, the CNA Environmental ceiling network-service deployment: up to 9.8 Vector v4.0:...

PYSEC-2026-4205 datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

Linux Distros Unpatched Vulnerability : CVE-2026-107377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply...

OPENSUSE-SU-2026:12096-1 python313-datamodel-code-generator-0.83.0-1.1 on GA media

These are all security issues fixed in the python313-datamodel-code-generator-0.83.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

UBUNTU-CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

External Control of File Name or Path

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to External Control of File Name or Path via the writemissingweakimports method in src/datamodelcodegenerator/parser/protobuf.py when processing a Protocol Buffers schema file containi...

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

agency-swarm (>=1.10.0, <=1.11.0), appai (1.0.1) +7 more potentially affected by CVE-2026-107377 via datamodel-code-generator (>=0.59.1, <=0.76.2)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =0.61.0, =0.7.0, =1.3.0, =0.1.1, =0.5.0, =0.1.0, =0.2.0 Source cves: CVE-2026-107377 Source advisory: OSV:GHSA-77XJ-X4RM-935C...

agency-swarm (>=1.10.0, <=1.11.0), appai (1.0.1) +7 more potentially affected by CVE-2026-107377 via datamodel-code-generator (>=0.59.1, <=0.76.2)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =0.61.0, =0.7.0, =1.3.0, =0.1.1, =0.5.0, =0.1.0, =0.2.0 Source cves: CVE-2026-107377 Source advisory: SNYK:PYTHON-DATAMODELCODEGENERATOR-20574179...

agency-swarm (>=1.10.0, <=1.11.0), appai (1.0.1) +7 more potentially affected by CVE-2026-107377 via datamodel-code-generator (>=0.59.1, <=0.76.2)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =0.61.0, =0.7.0, =1.3.0, =0.1.1, =0.5.0, =0.1.0, =0.2.0 Source cves: CVE-2026-107377 Source advisory: GHSA-77XJ-X4RM-935C...

GHSA-77XJ-X4RM-935C datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

CVE-2026-107377

The datamodel-code-generator library (versions 0.59.0 through 0.81.0 ) is vulnerable to a path traversal attack when processing attacker-controlled Protobuf schemas. The root cause lies in the _write_missing_weak_imports function in src/datamodel_code_generator/parser/protobuf.py, which fails to ...

CVE-2026-107377 datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

agency-swarm (>=1.10.0, <=1.11.0), appai (1.0.1) +7 more potentially affected by CVE-2026-107377 via datamodel-code-generator (>=0.59.1, <=0.76.2)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =0.61.0, =0.7.0, =1.3.0, =0.1.1, =0.5.0, =0.1.0, =0.2.0 Source cves: CVE-2026-107377 Source advisory: MEND:CVE-2026-107377...

EUVD-2026-95134

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

CVE-2026-107377 datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

CVE-2026-107377: Improper Limitation of a Pathname to a Restricted Directory

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...