{"uuid": "605c5e65-bc29-4ddb-9d96-b7a636b218e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107377", "type": "seen", "source": "https://gist.github.com/alon710/3e22d3fd50d271868ba90ae51cdcae51", "content": "# CVE-2026-107377: CVE-2026-107377: Arbitrary File Write and Overwrite via Protobuf Weak Import Path Traversal in datamodel-code-generator\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107377\n\n## Summary\nA path traversal vulnerability in datamodel-code-generator allows remote attackers to write or overwrite arbitrary files on the local host filesystem via a manipulated Protobuf schema containing malicious weak import paths.\n\n## TL;DR\nUnsafe pathname concatenation using python's pathlib division (/) operator allows unauthenticated remote attackers to write or overwrite files outside the sandbox by supplying a crafted Protobuf schema.\n\n## Technical Details\n\n- **CWE ID**: CWE-22 / CWE-73\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.5 (High)\n- **Impact**: High Integrity Compromise (File Overwrite)\n- **Exploit Status**: Proof of Concept available in tests\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- datamodel-code-generator\n- **datamodel-code-generator**: >= 0.59.0, < 0.81.0 (Fixed in: `0.81.0`)\n\n## Mitigation\n\n- Upgrade datamodel-code-generator to version 0.81.0 or higher.\n- Isolate the code generation process in an unprivileged, read-only container environment.\n- Filter incoming .proto files to reject schemas containing relative pathing or absolute references in 'import weak' statements.\n\n**Remediation Steps:**\n1. Identify all deployment instances running datamodel-code-generator versions prior to 0.81.0.\n2. Update dependencies in requirements.txt or pyproject.toml to enforce 'datamodel-code-generator>=0.81.0'.\n3. Deploy the updated application and verify that validation fails when encountering weak imports pointing outside the workspace.\n4. Configure the underlying container or execution host to run the generation service with minimal system privileges.\n\n## References\n\n- [NVD - CVE-2026-107377](https://nvd.nist.gov/vuln/detail/CVE-2026-107377)\n- [GitHub Security Advisory GHSA-77xj-x4rm-935c](https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c)\n- [Official Fix Patch Commit](https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107377) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T19:30:29.000000Z"}