CVE-2026-55390 Details

A path traversal vulnerability allowing arbitrary local file reads has been identified in datamodel-code-generator versions 0.59.0 prior to 0.62.0. The issue arises in the XML Schema parsing component, specifically within the 'src/datamodel_code_generator/parser/xmlschema.py' file. When the tool processes XML Schema files, it resolves 'schemaLocation' attributes from 'xs:include', 'xs:import', 'xs:redefine', and 'xs:override' elements. This resolution is performed without restrictions, allowing attackers to read files outside the designated input directory by exploiting relative or absolute paths. The contents of the included files are then incorporated into the generated Python data models, potentially leading to unauthorized information disclosure.

Users are advised to update datamodel-code-generator to version 0.62.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the GitHub repository's release notes.