`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

Summary datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial...

EUVD-2026-50071

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-54655

Summary: datamodel-code-generator (Python) is vulnerable from versions 0.51.0 through 0.60.2 where x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are injected into generated field annotations without sufficient validation, allowing at...

CVE-2026-54655

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

Directory Traversal

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Directory Traversal via the schemaLocation attribute in XSD processing. An attacker can access arbitrary files on the local filesystem by supplying a crafted XML Schema file that us...

GHSA-442Q-2J6P-642G datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

Summary When generating models from an XML Schema --input-file-type xmlschema, datamodel-code-generator resolves , , , and schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read...

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

Summary When generating models from an XML Schema --input-file-type xmlschema, datamodel-code-generator resolves , , , and schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

GHSA-2RX5-2G7J-2659 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...

OPENSUSE-SU-2026:21470-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. - CVE-2026-46968: unauthorized creation, deletion or modification...

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Summary GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This...

GHSA-5FQM-CC34-FCF5 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Summary GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This...

GHSA-R5JH-Q2MW-GCX4 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefixpath, safedir. This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator...

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefixpath, safedir. This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator...

EUVD-2026-36071

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory...

GHSA-Q6VM-XQC9-V3FF Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control...