Vulnerability-Lookup

CVE-2026-107377 (GCVE-0-2026-107377)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:55 – Updated: 2026-10-08 17:55

Title

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7553 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/datamodel-code-generator/datam…	x_refsource_CONFIRM
https://github.com/datamodel-code-generator/datam…	x_refsource_MISC
https://github.com/datamodel-code-generator/datam…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
datamodel-code-generator	datamodel-code-generator	Affected: >= 0.59.0, < 0.81.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "datamodel-code-generator",
          "vendor": "datamodel-code-generator",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.59.0, \u003c 0.81.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:55:22.595Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c"
        },
        {
          "name": "https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc"
        },
        {
          "name": "https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0"
        }
      ],
      "source": {
        "advisory": "GHSA-77xj-x4rm-935c",
        "discovery": "UNKNOWN"
      },
      "title": "datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107377",
    "datePublished": "2026-10-08T17:55:22.595Z",
    "dateReserved": "2026-10-07T21:07:54.987Z",
    "dateUpdated": "2026-10-08T17:55:22.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "datamodel-code-generator",
                "vendor": "datamodel-code-generator",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 0.59.0, \u003c 0.81.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0."
          }
        ],
        "id": "CVE-2026-107377",
        "lastModified": "2026-10-08T18:17:23.367",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-08T18:17:22.973",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-73"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-107377

Vulnerability from fkie_nvd - Published: 2026-10-08 18:17 - Updated: 2026-10-08 18:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc
	security-advisories@github.com	https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0
	security-advisories@github.com	https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "datamodel-code-generator",
          "vendor": "datamodel-code-generator",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.59.0, \u003c 0.81.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0."
    }
  ],
  "id": "CVE-2026-107377",
  "lastModified": "2026-10-08T18:17:23.367",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-08T18:17:22.973",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-77XJ-X4RM-935C

Vulnerability from github – Published: 2026-10-08 17:58 – Updated: 2026-10-08 17:58

Summary

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Details

Summary

When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended __weak_imports__ temporary directory. Absolute import paths and relative paths containing .. could escape this directory.

An attacker could create directories and new files at locations writable by the process. Relative path traversal could also overwrite existing writable files because the existence check and the stub write used different base directories. An existing absolute target was skipped by the existence check.

Written content was limited to a generated Protobuf syntax declaration, syntax = "proto2"; or syntax = "proto3";, followed by a newline. This issue did not provide fully attacker-controlled file contents, and direct arbitrary code execution has not been demonstrated.

These filesystem side effects occurred before protoc ran. A subsequent compilation error did not undo them. A user or CI job must process the attacker-controlled schema for the issue to be triggered, whether the schema is supplied as a local file or fetched via --url.

The fix has been merged into the parent repository's main branch in 5e94b8f. A patched package release is not yet available. The technical details and PoC below describe the vulnerable implementation before that fix.

Affected component

Repository: datamodel-code-generator/datamodel-code-generator (formerly koxudaxi/datamodel-code-generator).
Analyzed at: released 0.80.0 (pip install datamodel-code-generator==0.80.0) and main @ commit 834731d56c0a90c182a0919f316069cf5ff0659a (2026-09-13). Both contained the identical vulnerable sink.
Sink / entry point (src/datamodel_code_generator/parser/protobuf.py, line numbers from 0.80.0):
Source: WEAK_IMPORT_PATTERN (protobuf.py:37) — attacker-controlled capture group.
Sink: _write_missing_weak_imports (protobuf.py:391-393) — weak_import_dir / import_path + mkdir(parents=True) + write_text.
Timing: called from _ProtoInputPreparer.__enter__ (protobuf.py:333), before protoc.main(...) runs inside the with body.
Preconditions: victim runs the tool (CLI or Python API) with --input-file-type protobuf on an attacker-controlled .proto, supplied as a local file (--input) or a remote URL (--url). Requires the grpcio-tools package (Protobuf support). The attacker does not need privileges on the affected system; filesystem effects are limited to locations writable by the code-generation process.

Severity

Proposed: High. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5.

Scored to match the project's own rating of the sibling path-traversal advisories CVE-2026-55389 / CVE-2026-55390, both AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5. This finding is the same attack surface (unvalidated path from a processed schema) with the impact moved from confidentiality (read) to integrity (write), hence C:N/I:H.
AV:N: the malicious schema can be fetched over the network via --url, consistent with how the siblings were scored.
I:H: attacker fully controls the write path and can create arbitrary directory trees and overwrite existing files; only the file content is constrained (a fixed syntax = "proto{2,3}"; line).
A:N chosen conservatively; overwriting build-critical files (lock files, __init__.py, entry points) can cause availability loss, which would argue A:L.
Honest alternative: if the reviewer treats "the victim must run the tool on the file" as user interaction (UI:R), the score is 6.5 (Moderate). The project used UI:N for the identical read-path siblings, so UI:N is used here for consistency.

Details

Source pattern — the imported path is captured with no character restriction:

# protobuf.py:37
WEAK_IMPORT_PATTERN = re.compile(r'^\s*import\s+weak\s+"([^"]+)"\s*;', re.MULTILINE)

Sink — the captured path is joined and written with no boundary check:

# protobuf.py:383-393  (_write_missing_weak_imports)
for import_path in WEAK_IMPORT_PATTERN.findall(text):
    if any((include_path / import_path).exists() for include_path in include_paths):
        continue
    stub = self.weak_import_dir / import_path        # no resolve(), no is_relative_to()
    stub.parent.mkdir(parents=True, exist_ok=True)   # arbitrary directory tree
    stub.write_text(syntax, encoding=self.parser.encoding)

Two escape mechanisms, both from pathlib's / semantics:

Absolute path: Path(".../__weak_imports__") / "/etc/x" == /etc/x (an absolute right operand replaces the base). Creates new files anywhere the process can write.
../ traversal: Path(".../__weak_imports__") / "../../x" climbs out of the temp directory.

Why the existence guard (line 389) does not protect the write: it checks include_path / import_path, using a different base (include_paths) than the actual write, which uses self.weak_import_dir / import_path. For a relative path the two bases resolve to different directories, so the guard checks a location that is not the real write target and misses it — enabling overwrite of existing files. (For an absolute path the guard and the write coincide, so an already- existing absolute target is skipped; absolute paths thus create new files but do not overwrite. Overwrite is reached via the relative-traversal path.)

Timing: _write_missing_weak_imports runs inside __enter__ (line 333), and protoc.main(...) runs later in the with body. protoc rejects the malformed virtual path (Backslashes, consecutive slashes, "." or ".." are not allowed in the virtual path) and the overall command exits non-zero — but the file has already been written; the filesystem side effect is not rolled back.

Attack path

Attacker crafts evil.proto containing e.g. import weak "/home/victim/.config/x"; and/or import weak "../../overwrite_me.txt";, and gets the victim to process it (third-party schema, or --url to an attacker-hosted file).
_write_missing_weak_imports writes the stub to the attacker-chosen path, creating any intermediate directories and overwriting an existing file (relative case).
protoc then fails, but the file(s) are already on disk.

Proof of Concept

Two self-contained scripts (poc/reproduce.sh for --input, poc/reproduce-url.sh for --url) install the released datamodel-code-generator==0.80.0, serve/point a malicious .proto, and assert the writes. The PoC drives the released package unmodified; the sink file's sha256 is recorded in REPRODUCE.md.

Local --input run against 0.80.0 — real output:

[*] installed version: 0.80.0
[test A] absolute-path arbitrary file + mkdir(parents):
  [PASS] new file created at attacker-controlled absolute path
  [PASS] content is the fixed syntax stub
[test B] relative-traversal overwrite of pre-existing file:
  [PASS] pre-existing victim.txt content was overwritten
  [PASS] victim.txt now holds the injected stub
==================== RESULT: 4 passed, 0 failed ====================

Remote --url run against 0.80.0 — real output (proto served over HTTP, then the same writes fire):

[*] serving malicious proto at http://127.0.0.1:<port>/evil_url.proto
  [PASS] server actually served the proto (HTTP 200)
  [PASS] absolute-path arbitrary file created
  [PASS] pre-existing victim overwritten via ../
==================== RESULT: 3 passed, 0 failed ====================

Impact

Any user or CI pipeline that runs an affected version of datamodel-code-generator on an untrusted Protobuf schema (a downloaded third-party .proto, or --url to a remote source) is exposed to arbitrary file/directory creation and overwrite by the schema author, with the process's own permissions. Concrete harms:

Overwrite source, config, .env, lock files, or __init__.py / entry-point files → project corruption, broken builds, denial of service.
Create arbitrary directory trees / drop files into watched or auto-loaded locations.

Direct arbitrary code execution has not been demonstrated. The written content is limited to a generated syntax = "proto2"; or syntax = "proto3"; line and is not fully attacker-controlled.

Resolution

The fix was merged into the parent repository's main branch in 5e94b8f.

The Protobuf input preparer now resolves the dedicated temporary weak-import directory and each candidate stub path. If a resolved candidate is outside that directory, it raises SchemaParseError before checking include paths, creating parent directories, or writing the stub. The containment check rejects absolute-path escapes and relative .. traversal that would leave the sandbox.

Input-preparation failures also immediately clean up the temporary directory.

Regression tests cover:

rejection of absolute weak-import paths outside the sandbox;
rejection of relative .. traversal outside the sandbox;
preservation of a pre-existing file outside the sandbox.

Local tox validation of the patch passed across the Python 3.10–3.14 and formatter matrix, the CI compatibility environments, and the repository checks. Combined line and branch coverage, including the changed files, reached 100%.

A fixed package has not yet been published to PyPI; the latest published version at the time of this update is 0.80.0. Patched versions remains unset until a release containing this fix is available. The advisory remains private pending that release.

References

GHSA-8359-h9fx-j6v9 / CVE-2026-55389 — datamodel-code-generator arbitrary local file read via JSON-Schema $ref path traversal (CWE-22/200/610, 7.5, patched 0.62.0). Same class, read primitive; sibling entry point.
GHSA-442q-2j6p-642g / CVE-2026-55390 — datamodel-code-generator arbitrary local file read via XSD schemaLocation path traversal (CWE-22/200/610, 7.5, affected >= 0.59.0, <= 0.61.0, patched 0.62.0). Same class, read primitive; the fix sweep that missed the Protobuf entry point.
Python pathlib — PurePath.__truediv__: an absolute right-hand operand discards the left operand; .. segments are not normalized. (https://docs.python.org/3/library/pathlib.html)

Discovery

Found via source review and a reproducing PoC on datamodel-code-generator/datamodel-code-generator, released 0.80.0 and main @ 834731d56c0a90c182a0919f316069cf5ff0659a, 2026-09.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.80.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "datamodel-code-generator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.59.0"
            },
            {
              "fixed": "0.81.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T17:58:01Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nWhen processing an attacker-controlled Protobuf schema, vulnerable versions of\n`datamodel-code-generator` could write a generated weak-import stub outside the\nintended `__weak_imports__` temporary directory. Absolute import paths and relative\npaths containing `..` could escape this directory.\n\nAn attacker could create directories and new files at locations writable by the\nprocess. Relative path traversal could also overwrite existing writable files\nbecause the existence check and the stub write used different base directories.\nAn existing absolute target was skipped by the existence check.\n\nWritten content was limited to a generated Protobuf syntax declaration,\n`syntax = \"proto2\";` or `syntax = \"proto3\";`, followed by a newline. This issue did\nnot provide fully attacker-controlled file contents, and direct arbitrary code\nexecution has not been demonstrated.\n\nThese filesystem side effects occurred before `protoc` ran. A subsequent\ncompilation error did not undo them. A user or CI job must process the\nattacker-controlled schema for the issue to be triggered, whether the schema is\nsupplied as a local file or fetched via `--url`.\n\nThe fix has been merged into the parent repository\u0027s `main` branch in\n[5e94b8f](https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc). A patched package release is not yet available.\nThe technical details and PoC below describe the vulnerable implementation before\nthat fix.\n\n## Affected component\n\n- Repository: `datamodel-code-generator/datamodel-code-generator` (formerly `koxudaxi/datamodel-code-generator`).\n- Analyzed at: released **0.80.0** (`pip install datamodel-code-generator==0.80.0`) and `main` @ commit `834731d56c0a90c182a0919f316069cf5ff0659a` (2026-09-13). Both contained the identical vulnerable sink.\n- Sink / entry point (`src/datamodel_code_generator/parser/protobuf.py`, line numbers from 0.80.0):\n  - Source: `WEAK_IMPORT_PATTERN` (`protobuf.py:37`) \u2014 attacker-controlled capture group.\n  - Sink: `_write_missing_weak_imports` (`protobuf.py:391-393`) \u2014 `weak_import_dir / import_path` + `mkdir(parents=True)` + `write_text`.\n  - Timing: called from `_ProtoInputPreparer.__enter__` (`protobuf.py:333`), before `protoc.main(...)` runs inside the `with` body.\n- Preconditions: victim runs the tool (CLI or Python API) with `--input-file-type protobuf` on an attacker-controlled `.proto`, supplied as a local file (`--input`) or a remote URL (`--url`). Requires the `grpcio-tools` package (Protobuf support). The attacker does not need privileges on the affected system; filesystem effects are limited to locations writable by the code-generation process.\n\n## Severity\n\nProposed: **High**. `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` = **7.5**.\n\n- Scored to match the project\u0027s own rating of the sibling path-traversal advisories CVE-2026-55389 / CVE-2026-55390, both `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` = 7.5. This finding is the same attack surface (unvalidated path from a processed schema) with the impact moved from confidentiality (read) to **integrity (write)**, hence `C:N/I:H`.\n- `AV:N`: the malicious schema can be fetched over the network via `--url`, consistent with how the siblings were scored.\n- `I:H`: attacker fully controls the write path and can create arbitrary directory trees and overwrite existing files; only the file *content* is constrained (a fixed `syntax = \"proto{2,3}\";` line).\n- `A:N` chosen conservatively; overwriting build-critical files (lock files, `__init__.py`, entry points) can cause availability loss, which would argue `A:L`.\n- Honest alternative: if the reviewer treats \"the victim must run the tool on the file\" as user interaction (`UI:R`), the score is **6.5 (Moderate)**. The project used `UI:N` for the identical read-path siblings, so `UI:N` is used here for consistency.\n\n## Details\n\nSource pattern \u2014 the imported path is captured with no character restriction:\n\n```python\n# protobuf.py:37\nWEAK_IMPORT_PATTERN = re.compile(r\u0027^\\s*import\\s+weak\\s+\"([^\"]+)\"\\s*;\u0027, re.MULTILINE)\n```\n\nSink \u2014 the captured path is joined and written with no boundary check:\n\n```python\n# protobuf.py:383-393  (_write_missing_weak_imports)\nfor import_path in WEAK_IMPORT_PATTERN.findall(text):\n    if any((include_path / import_path).exists() for include_path in include_paths):\n        continue\n    stub = self.weak_import_dir / import_path        # no resolve(), no is_relative_to()\n    stub.parent.mkdir(parents=True, exist_ok=True)   # arbitrary directory tree\n    stub.write_text(syntax, encoding=self.parser.encoding)\n```\n\nTwo escape mechanisms, both from `pathlib`\u0027s `/` semantics:\n\n- **Absolute path**: `Path(\".../__weak_imports__\") / \"/etc/x\"` == `/etc/x` (an absolute\n  right operand replaces the base). Creates new files anywhere the process can write.\n- **`../` traversal**: `Path(\".../__weak_imports__\") / \"../../x\"` climbs out of the\n  temp directory.\n\nWhy the existence guard (line 389) does not protect the write: it checks\n`include_path / import_path`, using a **different base** (`include_paths`) than the\nactual write, which uses `self.weak_import_dir / import_path`. For a *relative*\npath the two bases resolve to different directories, so the guard checks a location\nthat is not the real write target and misses it \u2014 enabling **overwrite of existing\nfiles**. (For an absolute path the guard and the write coincide, so an already-\nexisting absolute target is skipped; absolute paths thus create new files but do not\noverwrite. Overwrite is reached via the relative-traversal path.)\n\nTiming: `_write_missing_weak_imports` runs inside `__enter__` (line 333), and\n`protoc.main(...)` runs later in the `with` body. `protoc` rejects the malformed\nvirtual path (`Backslashes, consecutive slashes, \".\" or \"..\" are not allowed in\nthe virtual path`) and the overall command exits non-zero \u2014 but the file has\nalready been written; the filesystem side effect is not rolled back.\n\n### Attack path\n\n1. Attacker crafts `evil.proto` containing e.g. `import weak \"/home/victim/.config/x\";`\n   and/or `import weak \"../../overwrite_me.txt\";`, and gets the victim to process it\n   (third-party schema, or `--url` to an attacker-hosted file).\n2. `_write_missing_weak_imports` writes the stub to the attacker-chosen path,\n   creating any intermediate directories and overwriting an existing file (relative\n   case).\n3. `protoc` then fails, but the file(s) are already on disk.\n\n## Proof of Concept\n\nTwo self-contained scripts (`poc/reproduce.sh` for `--input`, `poc/reproduce-url.sh`\nfor `--url`) install the released `datamodel-code-generator==0.80.0`, serve/point a\nmalicious `.proto`, and assert the writes. The PoC drives the **released** package\nunmodified; the sink file\u0027s sha256 is recorded in `REPRODUCE.md`.\n\nLocal `--input` run against 0.80.0 \u2014 real output:\n\n```\n[*] installed version: 0.80.0\n[test A] absolute-path arbitrary file + mkdir(parents):\n  [PASS] new file created at attacker-controlled absolute path\n  [PASS] content is the fixed syntax stub\n[test B] relative-traversal overwrite of pre-existing file:\n  [PASS] pre-existing victim.txt content was overwritten\n  [PASS] victim.txt now holds the injected stub\n==================== RESULT: 4 passed, 0 failed ====================\n```\n\nRemote `--url` run against 0.80.0 \u2014 real output (proto served over HTTP, then the\nsame writes fire):\n\n```\n[*] serving malicious proto at http://127.0.0.1:\u003cport\u003e/evil_url.proto\n  [PASS] server actually served the proto (HTTP 200)\n  [PASS] absolute-path arbitrary file created\n  [PASS] pre-existing victim overwritten via ../\n==================== RESULT: 3 passed, 0 failed ====================\n```\n\n## Impact\n\nAny user or CI pipeline that runs an affected version of\n`datamodel-code-generator` on an untrusted\nProtobuf schema (a downloaded third-party `.proto`, or `--url` to a remote source)\nis exposed to arbitrary file/directory creation and overwrite by the schema author,\nwith the process\u0027s own permissions. Concrete harms:\n\n- Overwrite source, config, `.env`, lock files, or `__init__.py` / entry-point\n  files \u2192 project corruption, broken builds, denial of service.\n- Create arbitrary directory trees / drop files into watched or auto-loaded\n  locations.\n\nDirect arbitrary code execution has not been demonstrated. The written content\nis limited to a generated `syntax = \"proto2\";` or `syntax = \"proto3\";` line and is\nnot fully attacker-controlled.\n\n## Resolution\n\nThe fix was merged into the parent repository\u0027s `main` branch in\n[5e94b8f](https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc).\n\nThe Protobuf input preparer now resolves the dedicated temporary weak-import\ndirectory and each candidate stub path. If a resolved candidate is outside that\ndirectory, it raises `SchemaParseError` before checking include paths, creating\nparent directories, or writing the stub. The containment check rejects\nabsolute-path escapes and relative `..` traversal that would leave the sandbox.\n\nInput-preparation failures also immediately clean up the temporary directory.\n\nRegression tests cover:\n\n- rejection of absolute weak-import paths outside the sandbox;\n- rejection of relative `..` traversal outside the sandbox;\n- preservation of a pre-existing file outside the sandbox.\n\nLocal tox validation of the patch passed across the Python 3.10\u20133.14 and formatter\nmatrix, the CI compatibility environments, and the repository checks. Combined\nline and branch coverage, including the changed files, reached 100%.\n\nA fixed package has not yet been published to PyPI; the latest published version\nat the time of this update is 0.80.0. `Patched versions` remains unset until a\nrelease containing this fix is available. The advisory remains private pending\nthat release.\n\n## References\n\n- GHSA-8359-h9fx-j6v9 / CVE-2026-55389 \u2014 datamodel-code-generator arbitrary local file **read** via JSON-Schema `$ref` path traversal (CWE-22/200/610, 7.5, patched 0.62.0). Same class, read primitive; sibling entry point.\n- GHSA-442q-2j6p-642g / CVE-2026-55390 \u2014 datamodel-code-generator arbitrary local file **read** via XSD `schemaLocation` path traversal (CWE-22/200/610, 7.5, affected `\u003e= 0.59.0, \u003c= 0.61.0`, patched 0.62.0). Same class, read primitive; the fix sweep that missed the Protobuf entry point.\n- Python `pathlib` \u2014 `PurePath.__truediv__`: an absolute right-hand operand discards the left operand; `..` segments are not normalized. (https://docs.python.org/3/library/pathlib.html)\n\n## Discovery\n\nFound via source review and a reproducing PoC on\n`datamodel-code-generator/datamodel-code-generator`, released 0.80.0 and `main` @\n`834731d56c0a90c182a0919f316069cf5ff0659a`, 2026-09.",
  "id": "GHSA-77xj-x4rm-935c",
  "modified": "2026-10-08T17:58:01Z",
  "published": "2026-10-08T17:58:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/datamodel-code-generator/datamodel-code-generator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-107377 (GCVE-0-2026-107377)

FKIE_CVE-2026-107377

GHSA-77XJ-X4RM-935C

Summary

Affected component

Severity

Details

Attack path

Proof of Concept

Impact

Resolution

References

Discovery

Tags

Sightings

Nomenclature

Related by attack behaviour