CVE-2026-55390

Received Received - Intake

XML External Entity Injection in datamodel-code-generator

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-55390

Affected Vendors & Products

Vendor	Product	Version / Range
datamodel-code-generator	datamodel-code-generator	From 0.59.0 (inc) to 0.62.0 (inc)
datamodel-code-generator	datamodel-code-generator	0.62.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-610	The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

The vulnerability in datamodel-code-generator (versions 0.59.0 to 0.62.0) involves XML Schema parsing that resolves external schema references like xs:include, xs:import, xs:redefine, and xs:override. These references can point to files outside the intended base path, allowing the tool to read arbitrary local files and include their contents in generated Python data models.

Detection Guidance

Check the installed version of datamodel-code-generator. If it is between 0.59.0 and 0.62.0, the system is vulnerable. Run: pip show datamodel-code-generator

Impact Analysis

This vulnerability could allow an attacker to read sensitive files on your system by crafting a malicious XML Schema file. If you use the affected versions to generate data models from XML Schemas, the tool may unintentionally expose local file contents in the generated output, potentially leaking confidential or system information.

Compliance Impact

The vulnerability allows arbitrary local files to be read and reflected into generated models due to improper handling of XML schema includes and imports. This could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's confidentiality rules if protected health information is exposed.

Mitigation Strategies

Upgrade datamodel-code-generator to version 0.62.0 or later. Run: pip install --upgrade datamodel-code-generator

Hi! I’m here to help you understand CVE-2026-55390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70