CVE-2026-55390

7.5 Élevée

Publiée le 29/07/2026 à 00:17 · Modifiée le 30/07/2026 à 22:02 · Analyse NVD reportée · Source : security-advisories@github.com

Description

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0.

Traduire en français

Produits concernés

koxudaxi datamodel-code-generator

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-22
CWE-200
CWE-610

Références

https://github.com/koxudaxi/datamodel-code-generator/commit/d2d5cecd9fd3a2a6dbf148bf0740b83a11fc6820
https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0
https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-442q-2j6p-642g
https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-442q-2j6p-642g

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories