deps: update dependency datamodel-code-generator to v0.81.0 [security] by renovate[bot] · Pull Request #351 · Flagsmith/flagsmith-engine

renovate · 2026-10-13T12:43:51Z

This PR contains the following updates:

Package	Change	Age	Confidence
datamodel-code-generator	`==0.75.1` → `==0.81.0`

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

CVE-2026-107377 / GHSA-77xj-x4rm-935c

More information

Details

Summary

When processing an attacker-controlled Protobuf schema, vulnerable versions of
datamodel-code-generator could write a generated weak-import stub outside the
intended __weak_imports__ temporary directory. Absolute import paths and relative
paths containing .. could escape this directory.

An attacker could create directories and new files at locations writable by the
process. Relative path traversal could also overwrite existing writable files
because the existence check and the stub write used different base directories.
An existing absolute target was skipped by the existence check.

Written content was limited to a generated Protobuf syntax declaration,
syntax = "proto2"; or syntax = "proto3";, followed by a newline. This issue did
not provide fully attacker-controlled file contents, and direct arbitrary code
execution has not been demonstrated.

These filesystem side effects occurred before protoc ran. A subsequent
compilation error did not undo them. A user or CI job must process the
attacker-controlled schema for the issue to be triggered, whether the schema is
supplied as a local file or fetched via --url.

The fix has been merged into the parent repository's main branch in
5e94b8f. A patched package release is not yet available.
The technical details and PoC below describe the vulnerable implementation before
that fix.

Affected component

Repository: datamodel-code-generator/datamodel-code-generator (formerly koxudaxi/datamodel-code-generator).
Analyzed at: released 0.80.0 (pip install datamodel-code-generator==0.80.0) and main @ commit 834731d56c0a90c182a0919f316069cf5ff0659a (2026-09-13). Both contained the identical vulnerable sink.
Sink / entry point (src/datamodel_code_generator/parser/protobuf.py, line numbers from 0.80.0):
- Source: WEAK_IMPORT_PATTERN (protobuf.py:37) — attacker-controlled capture group.
- Sink: _write_missing_weak_imports (protobuf.py:391-393) — weak_import_dir / import_path + mkdir(parents=True) + write_text.
- Timing: called from _ProtoInputPreparer.__enter__ (protobuf.py:333), before protoc.main(...) runs inside the with body.
Preconditions: victim runs the tool (CLI or Python API) with --input-file-type protobuf on an attacker-controlled .proto, supplied as a local file (--input) or a remote URL (--url). Requires the grpcio-tools package (Protobuf support). The attacker does not need privileges on the affected system; filesystem effects are limited to locations writable by the code-generation process.

Severity

Proposed: High. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5.

Scored to match the project's own rating of the sibling path-traversal advisories CVE-2026-55389 / CVE-2026-55390, both AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5. This finding is the same attack surface (unvalidated path from a processed schema) with the impact moved from confidentiality (read) to integrity (write), hence C:N/I:H.
AV:N: the malicious schema can be fetched over the network via --url, consistent with how the siblings were scored.
I:H: attacker fully controls the write path and can create arbitrary directory trees and overwrite existing files; only the file content is constrained (a fixed syntax = "proto{2,3}"; line).
A:N chosen conservatively; overwriting build-critical files (lock files, __init__.py, entry points) can cause availability loss, which would argue A:L.
Honest alternative: if the reviewer treats "the victim must run the tool on the file" as user interaction (UI:R), the score is 6.5 (Moderate). The project used UI:N for the identical read-path siblings, so UI:N is used here for consistency.

Details

Source pattern — the imported path is captured with no character restriction:

##### protobuf.py:37
WEAK_IMPORT_PATTERN = re.compile(r'^\s*import\s+weak\s+"([^"]+)"\s*;', re.MULTILINE)

Sink — the captured path is joined and written with no boundary check:

##### protobuf.py:383-393  (_write_missing_weak_imports)
for import_path in WEAK_IMPORT_PATTERN.findall(text):
    if any((include_path / import_path).exists() for include_path in include_paths):
        continue
    stub = self.weak_import_dir / import_path        # no resolve(), no is_relative_to()
    stub.parent.mkdir(parents=True, exist_ok=True)   # arbitrary directory tree
    stub.write_text(syntax, encoding=self.parser.encoding)

Two escape mechanisms, both from pathlib's / semantics:

Absolute path: Path(".../__weak_imports__") / "/etc/x" == /etc/x (an absolute
right operand replaces the base). Creates new files anywhere the process can write.
../ traversal: Path(".../__weak_imports__") / "../../x" climbs out of the
temp directory.

Why the existence guard (line 389) does not protect the write: it checks
include_path / import_path, using a different base (include_paths) than the
actual write, which uses self.weak_import_dir / import_path. For a relative
path the two bases resolve to different directories, so the guard checks a location
that is not the real write target and misses it — enabling overwrite of existing
files. (For an absolute path the guard and the write coincide, so an already-
existing absolute target is skipped; absolute paths thus create new files but do not
overwrite. Overwrite is reached via the relative-traversal path.)

Timing: _write_missing_weak_imports runs inside __enter__ (line 333), and
protoc.main(...) runs later in the with body. protoc rejects the malformed
virtual path (Backslashes, consecutive slashes, "." or ".." are not allowed in the virtual path) and the overall command exits non-zero — but the file has
already been written; the filesystem side effect is not rolled back.

Attack path

Attacker crafts evil.proto containing e.g. import weak "/home/victim/.config/x";
and/or import weak "../../overwrite_me.txt";, and gets the victim to process it
(third-party schema, or --url to an attacker-hosted file).
_write_missing_weak_imports writes the stub to the attacker-chosen path,
creating any intermediate directories and overwriting an existing file (relative
case).
protoc then fails, but the file(s) are already on disk.

Proof of Concept

Two self-contained scripts (poc/reproduce.sh for --input, poc/reproduce-url.sh
for --url) install the released datamodel-code-generator==0.80.0, serve/point a
malicious .proto, and assert the writes. The PoC drives the released package
unmodified; the sink file's sha256 is recorded in REPRODUCE.md.

Local --input run against 0.80.0 — real output:

[*] installed version: 0.80.0
[test A] absolute-path arbitrary file + mkdir(parents):
  [PASS] new file created at attacker-controlled absolute path
  [PASS] content is the fixed syntax stub
[test B] relative-traversal overwrite of pre-existing file:
  [PASS] pre-existing victim.txt content was overwritten
  [PASS] victim.txt now holds the injected stub
==================== RESULT: 4 passed, 0 failed ====================

Remote --url run against 0.80.0 — real output (proto served over HTTP, then the
same writes fire):

[*] serving malicious proto at http://127.0.0.1:<port>/evil_url.proto
  [PASS] server actually served the proto (HTTP 200)
  [PASS] absolute-path arbitrary file created
  [PASS] pre-existing victim overwritten via ../
==================== RESULT: 3 passed, 0 failed ====================

Impact

Any user or CI pipeline that runs an affected version of
datamodel-code-generator on an untrusted
Protobuf schema (a downloaded third-party .proto, or --url to a remote source)
is exposed to arbitrary file/directory creation and overwrite by the schema author,
with the process's own permissions. Concrete harms:

Overwrite source, config, .env, lock files, or __init__.py / entry-point
files → project corruption, broken builds, denial of service.
Create arbitrary directory trees / drop files into watched or auto-loaded
locations.

Direct arbitrary code execution has not been demonstrated. The written content
is limited to a generated syntax = "proto2"; or syntax = "proto3"; line and is
not fully attacker-controlled.

Resolution

The fix was merged into the parent repository's main branch in
5e94b8f.

The Protobuf input preparer now resolves the dedicated temporary weak-import
directory and each candidate stub path. If a resolved candidate is outside that
directory, it raises SchemaParseError before checking include paths, creating
parent directories, or writing the stub. The containment check rejects
absolute-path escapes and relative .. traversal that would leave the sandbox.

Input-preparation failures also immediately clean up the temporary directory.

Regression tests cover:

rejection of absolute weak-import paths outside the sandbox;
rejection of relative .. traversal outside the sandbox;
preservation of a pre-existing file outside the sandbox.

Local tox validation of the patch passed across the Python 3.10–3.14 and formatter
matrix, the CI compatibility environments, and the repository checks. Combined
line and branch coverage, including the changed files, reached 100%.

A fixed package has not yet been published to PyPI; the latest published version
at the time of this update is 0.80.0. Patched versions remains unset until a
release containing this fix is available. The advisory remains private pending
that release.

References

GHSA-8359-h9fx-j6v9 / CVE-2026-55389 — datamodel-code-generator arbitrary local file read via JSON-Schema $ref path traversal (CWE-22/200/610, 7.5, patched 0.62.0). Same class, read primitive; sibling entry point.
GHSA-442q-2j6p-642g / CVE-2026-55390 — datamodel-code-generator arbitrary local file read via XSD schemaLocation path traversal (CWE-22/200/610, 7.5, affected >= 0.59.0, <= 0.61.0, patched 0.62.0). Same class, read primitive; the fix sweep that missed the Protobuf entry point.
Python pathlib — PurePath.__truediv__: an absolute right-hand operand discards the left operand; .. segments are not normalized. (https://docs.python.org/3/library/pathlib.html)

Discovery

Found via source review and a reproducing PoC on
datamodel-code-generator/datamodel-code-generator, released 0.80.0 and main @
834731d56c0a90c182a0919f316069cf5ff0659a, 2026-09.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

CVE-2026-107377 / GHSA-77xj-x4rm-935c / PYSEC-2026-4205

More information

Details

Summary

When processing an attacker-controlled Protobuf schema, vulnerable versions of
datamodel-code-generator could write a generated weak-import stub outside the
intended __weak_imports__ temporary directory. Absolute import paths and relative
paths containing .. could escape this directory.

An attacker could create directories and new files at locations writable by the
process. Relative path traversal could also overwrite existing writable files
because the existence check and the stub write used different base directories.
An existing absolute target was skipped by the existence check.

Written content was limited to a generated Protobuf syntax declaration,
syntax = "proto2"; or syntax = "proto3";, followed by a newline. This issue did
not provide fully attacker-controlled file contents, and direct arbitrary code
execution has not been demonstrated.

These filesystem side effects occurred before protoc ran. A subsequent
compilation error did not undo them. A user or CI job must process the
attacker-controlled schema for the issue to be triggered, whether the schema is
supplied as a local file or fetched via --url.

The fix has been merged into the parent repository's main branch in
5e94b8f. A patched package release is not yet available.
The technical details and PoC below describe the vulnerable implementation before
that fix.

Affected component

Repository: datamodel-code-generator/datamodel-code-generator (formerly koxudaxi/datamodel-code-generator).
Analyzed at: released 0.80.0 (pip install datamodel-code-generator==0.80.0) and main @ commit 834731d56c0a90c182a0919f316069cf5ff0659a (2026-09-13). Both contained the identical vulnerable sink.
Sink / entry point (src/datamodel_code_generator/parser/protobuf.py, line numbers from 0.80.0):
- Source: WEAK_IMPORT_PATTERN (protobuf.py:37) — attacker-controlled capture group.
- Sink: _write_missing_weak_imports (protobuf.py:391-393) — weak_import_dir / import_path + mkdir(parents=True) + write_text.
- Timing: called from _ProtoInputPreparer.__enter__ (protobuf.py:333), before protoc.main(...) runs inside the with body.
Preconditions: victim runs the tool (CLI or Python API) with --input-file-type protobuf on an attacker-controlled .proto, supplied as a local file (--input) or a remote URL (--url). Requires the grpcio-tools package (Protobuf support). The attacker does not need privileges on the affected system; filesystem effects are limited to locations writable by the code-generation process.

Severity

Proposed: High. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5.

Scored to match the project's own rating of the sibling path-traversal advisories CVE-2026-55389 / CVE-2026-55390, both AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5. This finding is the same attack surface (unvalidated path from a processed schema) with the impact moved from confidentiality (read) to integrity (write), hence C:N/I:H.
AV:N: the malicious schema can be fetched over the network via --url, consistent with how the siblings were scored.
I:H: attacker fully controls the write path and can create arbitrary directory trees and overwrite existing files; only the file content is constrained (a fixed syntax = "proto{2,3}"; line).
A:N chosen conservatively; overwriting build-critical files (lock files, __init__.py, entry points) can cause availability loss, which would argue A:L.
Honest alternative: if the reviewer treats "the victim must run the tool on the file" as user interaction (UI:R), the score is 6.5 (Moderate). The project used UI:N for the identical read-path siblings, so UI:N is used here for consistency.

Details

Source pattern — the imported path is captured with no character restriction:

##### protobuf.py:37
WEAK_IMPORT_PATTERN = re.compile(r'^\s*import\s+weak\s+"([^"]+)"\s*;', re.MULTILINE)

Sink — the captured path is joined and written with no boundary check:

##### protobuf.py:383-393  (_write_missing_weak_imports)
for import_path in WEAK_IMPORT_PATTERN.findall(text):
    if any((include_path / import_path).exists() for include_path in include_paths):
        continue
    stub = self.weak_import_dir / import_path        # no resolve(), no is_relative_to()
    stub.parent.mkdir(parents=True, exist_ok=True)   # arbitrary directory tree
    stub.write_text(syntax, encoding=self.parser.encoding)

Two escape mechanisms, both from pathlib's / semantics:

Absolute path: Path(".../__weak_imports__") / "/etc/x" == /etc/x (an absolute
right operand replaces the base). Creates new files anywhere the process can write.
../ traversal: Path(".../__weak_imports__") / "../../x" climbs out of the
temp directory.

Why the existence guard (line 389) does not protect the write: it checks
include_path / import_path, using a different base (include_paths) than the
actual write, which uses self.weak_import_dir / import_path. For a relative
path the two bases resolve to different directories, so the guard checks a location
that is not the real write target and misses it — enabling overwrite of existing
files. (For an absolute path the guard and the write coincide, so an already-
existing absolute target is skipped; absolute paths thus create new files but do not
overwrite. Overwrite is reached via the relative-traversal path.)

Timing: _write_missing_weak_imports runs inside __enter__ (line 333), and
protoc.main(...) runs later in the with body. protoc rejects the malformed
virtual path (Backslashes, consecutive slashes, "." or ".." are not allowed in the virtual path) and the overall command exits non-zero — but the file has
already been written; the filesystem side effect is not rolled back.

Attack path

Attacker crafts evil.proto containing e.g. import weak "/home/victim/.config/x";
and/or import weak "../../overwrite_me.txt";, and gets the victim to process it
(third-party schema, or --url to an attacker-hosted file).
_write_missing_weak_imports writes the stub to the attacker-chosen path,
creating any intermediate directories and overwriting an existing file (relative
case).
protoc then fails, but the file(s) are already on disk.

Proof of Concept

Two self-contained scripts (poc/reproduce.sh for --input, poc/reproduce-url.sh
for --url) install the released datamodel-code-generator==0.80.0, serve/point a
malicious .proto, and assert the writes. The PoC drives the released package
unmodified; the sink file's sha256 is recorded in REPRODUCE.md.

Local --input run against 0.80.0 — real output:

[*] installed version: 0.80.0
[test A] absolute-path arbitrary file + mkdir(parents):
  [PASS] new file created at attacker-controlled absolute path
  [PASS] content is the fixed syntax stub
[test B] relative-traversal overwrite of pre-existing file:
  [PASS] pre-existing victim.txt content was overwritten
  [PASS] victim.txt now holds the injected stub
==================== RESULT: 4 passed, 0 failed ====================

Remote --url run against 0.80.0 — real output (proto served over HTTP, then the
same writes fire):

[*] serving malicious proto at http://127.0.0.1:<port>/evil_url.proto
  [PASS] server actually served the proto (HTTP 200)
  [PASS] absolute-path arbitrary file created
  [PASS] pre-existing victim overwritten via ../
==================== RESULT: 3 passed, 0 failed ====================

Impact

Any user or CI pipeline that runs an affected version of
datamodel-code-generator on an untrusted
Protobuf schema (a downloaded third-party .proto, or --url to a remote source)
is exposed to arbitrary file/directory creation and overwrite by the schema author,
with the process's own permissions. Concrete harms:

Overwrite source, config, .env, lock files, or __init__.py / entry-point
files → project corruption, broken builds, denial of service.
Create arbitrary directory trees / drop files into watched or auto-loaded
locations.

Direct arbitrary code execution has not been demonstrated. The written content
is limited to a generated syntax = "proto2"; or syntax = "proto3"; line and is
not fully attacker-controlled.

Resolution

The fix was merged into the parent repository's main branch in
5e94b8f.

The Protobuf input preparer now resolves the dedicated temporary weak-import
directory and each candidate stub path. If a resolved candidate is outside that
directory, it raises SchemaParseError before checking include paths, creating
parent directories, or writing the stub. The containment check rejects
absolute-path escapes and relative .. traversal that would leave the sandbox.

Input-preparation failures also immediately clean up the temporary directory.

Regression tests cover:

rejection of absolute weak-import paths outside the sandbox;
rejection of relative .. traversal outside the sandbox;
preservation of a pre-existing file outside the sandbox.

Local tox validation of the patch passed across the Python 3.10–3.14 and formatter
matrix, the CI compatibility environments, and the repository checks. Combined
line and branch coverage, including the changed files, reached 100%.

A fixed package has not yet been published to PyPI; the latest published version
at the time of this update is 0.80.0. Patched versions remains unset until a
release containing this fix is available. The advisory remains private pending
that release.

References

GHSA-8359-h9fx-j6v9 / CVE-2026-55389 — datamodel-code-generator arbitrary local file read via JSON-Schema $ref path traversal (CWE-22/200/610, 7.5, patched 0.62.0). Same class, read primitive; sibling entry point.
GHSA-442q-2j6p-642g / CVE-2026-55390 — datamodel-code-generator arbitrary local file read via XSD schemaLocation path traversal (CWE-22/200/610, 7.5, affected >= 0.59.0, <= 0.61.0, patched 0.62.0). Same class, read primitive; the fix sweep that missed the Protobuf entry point.
Python pathlib — PurePath.__truediv__: an absolute right-hand operand discards the left operand; .. segments are not normalized. (https://docs.python.org/3/library/pathlib.html)

Discovery

Found via source review and a reproducing PoC on
datamodel-code-generator/datamodel-code-generator, released 0.80.0 and main @
834731d56c0a90c182a0919f316069cf5ff0659a, 2026-09.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

CVE-2026-107377 / GHSA-77xj-x4rm-935c / PYSEC-2026-4205

More information

Details

Summary

When processing an attacker-controlled Protobuf schema, vulnerable versions of
datamodel-code-generator could write a generated weak-import stub outside the
intended __weak_imports__ temporary directory. Absolute import paths and relative
paths containing .. could escape this directory.

An attacker could create directories and new files at locations writable by the
process. Relative path traversal could also overwrite existing writable files
because the existence check and the stub write used different base directories.
An existing absolute target was skipped by the existence check.

Written content was limited to a generated Protobuf syntax declaration,
syntax = "proto2"; or syntax = "proto3";, followed by a newline. This issue did
not provide fully attacker-controlled file contents, and direct arbitrary code
execution has not been demonstrated.

These filesystem side effects occurred before protoc ran. A subsequent
compilation error did not undo them. A user or CI job must process the
attacker-controlled schema for the issue to be triggered, whether the schema is
supplied as a local file or fetched via --url.

The fix has been merged into the parent repository's main branch in
5e94b8f. A patched package release is not yet available.
The technical details and PoC below describe the vulnerable implementation before
that fix.

Affected component

Repository: datamodel-code-generator/datamodel-code-generator (formerly koxudaxi/datamodel-code-generator).
Analyzed at: released 0.80.0 (pip install datamodel-code-generator==0.80.0) and main @ commit 834731d56c0a90c182a0919f316069cf5ff0659a (2026-09-13). Both contained the identical vulnerable sink.
Sink / entry point (src/datamodel_code_generator/parser/protobuf.py, line numbers from 0.80.0):
- Source: WEAK_IMPORT_PATTERN (protobuf.py:37) — attacker-controlled capture group.
- Sink: _write_missing_weak_imports (protobuf.py:391-393) — weak_import_dir / import_path + mkdir(parents=True) + write_text.
- Timing: called from _ProtoInputPreparer.__enter__ (protobuf.py:333), before protoc.main(...) runs inside the with body.
Preconditions: victim runs the tool (CLI or Python API) with --input-file-type protobuf on an attacker-controlled .proto, supplied as a local file (--input) or a remote URL (--url). Requires the grpcio-tools package (Protobuf support). The attacker does not need privileges on the affected system; filesystem effects are limited to locations writable by the code-generation process.

Severity

Proposed: High. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5.

Scored to match the project's own rating of the sibling path-traversal advisories CVE-2026-55389 / CVE-2026-55390, both AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5. This finding is the same attack surface (unvalidated path from a processed schema) with the impact moved from confidentiality (read) to integrity (write), hence C:N/I:H.
AV:N: the malicious schema can be fetched over the network via --url, consistent with how the siblings were scored.
I:H: attacker fully controls the write path and can create arbitrary directory trees and overwrite existing files; only the file content is constrained (a fixed syntax = "proto{2,3}"; line).
A:N chosen conservatively; overwriting build-critical files (lock files, __init__.py, entry points) can cause availability loss, which would argue A:L.
Honest alternative: if the reviewer treats "the victim must run the tool on the file" as user interaction (UI:R), the score is 6.5 (Moderate). The project used UI:N for the identical read-path siblings, so UI:N is used here for consistency.

Details

Source pattern — the imported path is captured with no character restriction:

##### protobuf.py:37
WEAK_IMPORT_PATTERN = re.compile(r'^\s*import\s+weak\s+"([^"]+)"\s*;', re.MULTILINE)

Sink — the captured path is joined and written with no boundary check:

##### protobuf.py:383-393  (_write_missing_weak_imports)
for import_path in WEAK_IMPORT_PATTERN.findall(text):
    if any((include_path / import_path).exists() for include_path in include_paths):
        continue
    stub = self.weak_import_dir / import_path        # no resolve(), no is_relative_to()
    stub.parent.mkdir(parents=True, exist_ok=True)   # arbitrary directory tree
    stub.write_text(syntax, encoding=self.parser.encoding)

Two escape mechanisms, both from pathlib's / semantics:

Absolute path: Path(".../__weak_imports__") / "/etc/x" == /etc/x (an absolute
right operand replaces the base). Creates new files anywhere the process can write.
../ traversal: Path(".../__weak_imports__") / "../../x" climbs out of the
temp directory.

Why the existence guard (line 389) does not protect the write: it checks
include_path / import_path, using a different base (include_paths) than the
actual write, which uses self.weak_import_dir / import_path. For a relative
path the two bases resolve to different directories, so the guard checks a location
that is not the real write target and misses it — enabling overwrite of existing
files. (For an absolute path the guard and the write coincide, so an already-
existing absolute target is skipped; absolute paths thus create new files but do not
overwrite. Overwrite is reached via the relative-traversal path.)

Timing: _write_missing_weak_imports runs inside __enter__ (line 333), and
protoc.main(...) runs later in the with body. protoc rejects the malformed
virtual path (Backslashes, consecutive slashes, "." or ".." are not allowed in the virtual path) and the overall command exits non-zero — but the file has
already been written; the filesystem side effect is not rolled back.

Attack path

Attacker crafts evil.proto containing e.g. import weak "/home/victim/.config/x";
and/or import weak "../../overwrite_me.txt";, and gets the victim to process it
(third-party schema, or --url to an attacker-hosted file).
_write_missing_weak_imports writes the stub to the attacker-chosen path,
creating any intermediate directories and overwriting an existing file (relative
case).
protoc then fails, but the file(s) are already on disk.

Proof of Concept

Two self-contained scripts (poc/reproduce.sh for --input, poc/reproduce-url.sh
for --url) install the released datamodel-code-generator==0.80.0, serve/point a
malicious .proto, and assert the writes. The PoC drives the released package
unmodified; the sink file's sha256 is recorded in REPRODUCE.md.

Local --input run against 0.80.0 — real output:

[*] installed version: 0.80.0
[test A] absolute-path arbitrary file + mkdir(parents):
  [PASS] new file created at attacker-controlled absolute path
  [PASS] content is the fixed syntax stub
[test B] relative-traversal overwrite of pre-existing file:
  [PASS] pre-existing victim.txt content was overwritten
  [PASS] victim.txt now holds the injected stub
==================== RESULT: 4 passed, 0 failed ====================

Remote --url run against 0.80.0 — real output (proto served over HTTP, then the
same writes fire):

[*] serving malicious proto at http://127.0.0.1:<port>/evil_url.proto
  [PASS] server actually served the proto (HTTP 200)
  [PASS] absolute-path arbitrary file created
  [PASS] pre-existing victim overwritten via ../
==================== RESULT: 3 passed, 0 failed ====================

Impact

Any user or CI pipeline that runs an affected version of
datamodel-code-generator on an untrusted
Protobuf schema (a downloaded third-party .proto, or --url to a remote source)
is exposed to arbitrary file/directory creation and overwrite by the schema author,
with the process's own permissions. Concrete harms:

Overwrite source, config, .env, lock files, or __init__.py / entry-point
files → project corruption, broken builds, denial of service.
Create arbitrary directory trees / drop files into watched or auto-loaded
locations.

Direct arbitrary code execution has not been demonstrated. The written content
is limited to a generated syntax = "proto2"; or syntax = "proto3"; line and is
not fully attacker-controlled.

Resolution

The fix was merged into the parent repository's main branch in
5e94b8f.

The Protobuf input preparer now resolves the dedicated temporary weak-import
directory and each candidate stub path. If a resolved candidate is outside that
directory, it raises SchemaParseError before checking include paths, creating
parent directories, or writing the stub. The containment check rejects
absolute-path escapes and relative .. traversal that would leave the sandbox.

Input-preparation failures also immediately clean up the temporary directory.

Regression tests cover:

rejection of absolute weak-import paths outside the sandbox;
rejection of relative .. traversal outside the sandbox;
preservation of a pre-existing file outside the sandbox.

Local tox validation of the patch passed across the Python 3.10–3.14 and formatter
matrix, the CI compatibility environments, and the repository checks. Combined
line and branch coverage, including the changed files, reached 100%.

A fixed package has not yet been published to PyPI; the latest published version
at the time of this update is 0.80.0. Patched versions remains unset until a
release containing this fix is available. The advisory remains private pending
that release.

References

GHSA-8359-h9fx-j6v9 / CVE-2026-55389 — datamodel-code-generator arbitrary local file read via JSON-Schema $ref path traversal (CWE-22/200/610, 7.5, patched 0.62.0). Same class, read primitive; sibling entry point.
GHSA-442q-2j6p-642g / CVE-2026-55390 — datamodel-code-generator arbitrary local file read via XSD schemaLocation path traversal (CWE-22/200/610, 7.5, affected >= 0.59.0, <= 0.61.0, patched 0.62.0). Same class, read primitive; the fix sweep that missed the Protobuf entry point.
Python pathlib — PurePath.__truediv__: an absolute right-hand operand discards the left operand; .. segments are not normalized. (https://docs.python.org/3/library/pathlib.html)

Discovery

Found via source review and a reproducing PoC on
datamodel-code-generator/datamodel-code-generator, released 0.80.0 and main @
834731d56c0a90c182a0919f316069cf5ff0659a, 2026-09.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

datamodel-code-generator/datamodel-code-generator (datamodel-code-generator)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-10-13T12:44:01Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 8a85dcf0-7b2b-401e-bf65-b1f6974d64d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

deps: update dependency datamodel-code-generator to v0.81.0 [security]

c9ab0f3

renovate Bot requested a review from a team as a code owner October 13, 2026 12:43

renovate Bot requested review from emyller and removed request for a team October 13, 2026 12:43

Navigation Menu

Repository navigation

deps: update dependency datamodel-code-generator to v0.81.0 [security] - #351

deps: update dependency datamodel-code-generator to v0.81.0 [security]#351
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-datamodel-code-generator-vulnerability

renovate Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 13, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Details

Summary

Affected component

Severity

Details

Attack path

Proof of Concept

Impact

Resolution

References

Discovery

Severity

References

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Details

Summary

Affected component

Severity

Details

Attack path

Proof of Concept

Impact

Resolution

References

Discovery

Severity

References

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Details

Summary

Affected component

Severity

Details

Attack path

Proof of Concept

Impact

Resolution

References

Discovery

Severity

References

Release Notes

Configuration

Uh oh!

coderabbitai Bot commented Oct 13, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 13, 2026 •

edited

Loading