CVE-2026-55389 Details

A vulnerability in datamodel-code-generator prior to version 0.62.0 allows arbitrary local file reads through JSON Schema $ref references. The issue arises because the tool does not properly restrict file references to the input directory and ignores the --no-allow-remote-refs option. This flaw can be exploited using file:// URLs or relative references that traverse directories, bypassing intended security controls. As a result, an attacker can read any file accessible to the process user, potentially disclosing sensitive information such as secrets or internal schema data.

Users can update to datamodel-code-generator version 0.62.0 or later, where this vulnerability has been fixed. The update ensures that file references are properly validated and that the --no-allow-remote-refs option applies to file:// URLs, blocking unsafe references outside the input directory.