CVE-2026-55389

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0.

• CWE-22
• CWE-200
• CWE-610

• https://github.com/koxudaxi/datamodel-code-generator/commit/2ff4a72b4550a2b2069754c5b075b1655067e5fbPatch
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0Release Notes
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9Exploit, Vendor Advisory
• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9Exploit, Vendor Advisory

Published

Jul 28, 2026

Last Modified

Aug 6, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55370Logto is the modern, open-source auth infrastructure for Saa…6.4
• CVE-2026-55377Logto is the modern, open-source auth infrastructure for Saa…8.1
• CVE-2026-55379Pillow is a Python imaging library. Prior to 12.3.0, PIL/Bdf…7.5
• CVE-2026-5538A vulnerability was detected in QingdaoU OnlineJudge up to 1…6.3
• CVE-2026-55380Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdI…7.5
• CVE-2026-55388piscina is a node.js worker pool implementation. Prior to 6.…8.1
• CVE-2026-5539A flaw has been found in code-projects Simple Laundry System…4.3
• CVE-2026-55390datamodel-code-generator generates Python data models from s…7.5
• CVE-2026-55391datamodel-code-generator generates Pydantic v2 models, datac…7.5
• CVE-2026-55392NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilf…6.7
• CVE-2026-55398CVE-2026-55398 is a memory management vulnerability in Secur…3.7
• CVE-2026-55399CVE-2026-55399 is a resource exhaustion vulnerability in the…4.3