CVE-2026-55390: datamodel-code-generator Path Traversal

CVE-2026-55390 Overview

CVE-2026-55390 is a path traversal vulnerability [CWE-22] in datamodel-code-generator, a Python library that generates data models from schema definitions. The flaw resides in the XML Schema (XSD) parser located at src/datamodel_code_generator/parser/xmlschema.py. When processing input with --input-file-type xmlschema, the parser resolves xs:include, xs:import, xs:redefine, and xs:overrideschemaLocation values without confining them to the input base path. An attacker who supplies a crafted XSD file can force the tool to read arbitrary local files and reflect their contents into generated Python models. Affected versions span 0.59.0 through releases prior to 0.62.0.

Critical Impact
A malicious XSD schema can exfiltrate arbitrary local file contents by embedding them into generated Python data models, exposing source code, credentials, and configuration files handled by CI/CD pipelines and developer workstations.

Affected Products

datamodel-code-generator version 0.59.0
datamodel-code-generator versions after 0.59.0 and before 0.62.0
Toolchains and CI pipelines invoking the generator with --input-file-type xmlschema

Discovery Timeline

2026-07-28 - CVE-2026-55390 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-55390

Vulnerability Analysis

The generator parses XSD documents and follows external schema references declared through xs:include, xs:import, xs:redefine, and xs:override elements. Each of these elements carries a schemaLocation attribute pointing to another schema file. The parser joined the attribute value directly to source_dir and called .resolve(), permitting .. sequences or absolute paths to escape the intended input directory. As a result, references such as schemaLocation="../../../../etc/passwd" or an absolute path resolve to arbitrary files on the host filesystem. The parser then reads those files as if they were schemas and reflects portions of their content into the generated Python models. This exposes sensitive host data to any downstream consumer of the generated code, including source repositories and build artifacts.

Root Cause

The root cause is missing path containment. The vulnerable code performed (source_dir / schema_location).resolve() without validating that the resolved path stays inside source_dir. Any relative traversal segments or absolute paths were honored, violating trust boundaries between the untrusted schema input and the local filesystem.

Attack Vector

An attacker delivers a malicious XSD file to a victim running datamodel-code-generator with --input-file-type xmlschema. Delivery channels include pull requests to schema repositories, artifacts pulled by CI jobs, or shared schema bundles. The attacker requires no authentication or user interaction beyond the victim invoking the generator on the crafted input.

python

            schema_location = child.get("schemaLocation")
            if not schema_location:
                continue
-           location = (source_dir / schema_location).resolve()
+           location = self._resolve_schema_location(source_dir, schema_location)
            if location in seen or not location.is_file():
                continue
            seen.add(location)
# Source: https://github.com/koxudaxi/datamodel-code-generator/commit/d2d5cecd9fd3a2a6dbf148bf0740b83a11fc6820
# The fix replaces direct path joining with a helper that constrains resolution to the input base path.

Detection Methods for CVE-2026-55390

Indicators of Compromise

Generated Python model files containing unexpected string literals resembling /etc/passwd, SSH keys, .env values, or other host file contents.
XSD inputs containing xs:include, xs:import, xs:redefine, or xs:override elements with schemaLocation values containing .. traversal sequences or absolute paths.
CI build logs showing datamodel-code-generator reading files outside the schema working directory.

Detection Strategies

Scan XSD inputs for schemaLocation attributes that resolve outside the intended schema root before invoking the generator.
Diff newly generated Python models against expected schema-derived structures to surface reflected file contents.
Inventory datamodel-code-generator versions across developer workstations and CI runners; flag installations reporting a version in the 0.59.0 to 0.61.x range.

Monitoring Recommendations

Log filesystem reads performed by build agents during model generation and alert on access outside the schema directory.
Monitor package manifests such as requirements.txt, pyproject.toml, and poetry.lock for pinned vulnerable versions.
Track outbound artifact pushes from CI systems for generated code that contains sensitive strings.

How to Mitigate CVE-2026-55390

Immediate Actions Required

Upgrade datamodel-code-generator to version 0.62.0 or later on every workstation, container image, and CI runner.
Audit prior runs that used --input-file-type xmlschema and inspect generated models for leaked file contents.
Rotate any secrets, tokens, or keys that may have been exposed through generated artifacts committed to repositories.

Patch Information

The issue is fixed in datamodel-code-generator0.62.0. The patch introduces _resolve_schema_location, which constrains resolved paths to the input base directory before the parser reads them. Refer to the GitHub Security Advisory GHSA-442q-2j6p-642g, the GitHub Release 0.62.0 notes, and the fix commit.

Workarounds

Avoid running the generator with --input-file-type xmlschema on XSD input from untrusted sources until the upgrade is complete.
Run the tool inside an isolated sandbox or container with a read-only filesystem exposing only the intended schema directory.
Pre-process XSD files to strip schemaLocation values that contain .. traversal segments or absolute paths.

bash

# Upgrade to the patched release
pip install --upgrade 'datamodel-code-generator>=0.62.0'

# Verify the installed version
python -c "import datamodel_code_generator, sys; print(datamodel_code_generator.__version__)"

# Run future generations inside a constrained working directory
datamodel-codegen \
  --input ./schemas/trusted.xsd \
  --input-file-type xmlschema \
  --output ./generated/models.py