CVE-2026-107377 in datamodel-code-generator
Summary
by MITRE • 10/08/2026
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified within the datamodel-code-generator library affects versions ranging from 0.59.0 through 0.81.0, representing a significant path traversal and arbitrary file write flaw rooted in the handling of Protobuf schema definitions. This tool is designed to automatically generate Python data models based on provided schema specifications, a common practice in modern software development pipelines that rely on code generation for type safety and interoperability. The core technical failure occurs during the parsing phase when processing input schemas formatted as Protocol Buffers. Specifically, the parser utilizes a regular expression pattern known as WEAK_IMPORT_PATTERN to identify import statements within these schemas. This pattern is insufficiently restrictive, allowing it to match absolute file system paths or relative paths containing parent directory traversal sequences such as dot-dot-slash. When such maliciously crafted imports are detected, they are passed directly to the _write_missing_weak_imports function without adequate sanitization or validation of the resulting destination path.
The operational impact of this flaw is severe because it allows an attacker who controls the input schema to write files outside of the intended temporary directory structure used for weak imports. By supplying a schema with carefully constructed import paths, an adversary can cause the generator to create arbitrary directories and files on the host system where the code generation process is executed. This capability effectively bypasses standard sandboxing or isolation mechanisms that might rely on restricting file operations to specific working directories. The vulnerability persists even if the subsequent compilation step using protoc fails, meaning the malicious side effects of writing these unauthorized files are realized regardless of whether the final Protobuf artifacts are successfully generated. While the content written is limited to a proto2 or proto3 syntax declaration and direct arbitrary code execution has not been demonstrated in this specific context, the ability to overwrite existing writable files poses a substantial risk. An attacker could potentially replace legitimate configuration files, scripts, or other critical resources with maliciously crafted Protobuf declarations, leading to data integrity issues or serving as a precursor for more complex attacks such as supply chain poisoning if these generated artifacts are subsequently used in downstream processes.
From a classification perspective, this vulnerability aligns closely with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The mechanism involves failing to properly neutralize special elements within user-supplied data that could cause the file system interpreter to treat externally supplied input as part of a command or path. Furthermore, this behavior can be mapped to MITRE ATT&CK techniques related to File and Directory Information Discovery or potential persistence mechanisms if an attacker leverages the write capability to plant files in locations monitored by automated systems for later execution. The requirement for exploitation is specific: the victim environment must have the grpcio-tools package installed, as it provides the necessary Protobuf input support that triggers this code path. This dependency constraint means that while the vulnerability exists in the library itself, successful exploitation depends on the broader ecosystem configuration of the target application or development pipeline.
Mitigation strategies for organizations utilizing affected versions of datamodel-code-generator involve immediate upgrading to version 0.81.0 or later, where the issue has been resolved through stricter validation and sanitization of import paths before they are processed by file writing functions. For environments that cannot immediately upgrade, implementing strict input validation on all schema files consumed by the generator is essential. This includes rejecting any import statements that contain absolute paths or sequences indicating directory traversal. Additionally, running code generation processes with minimal privileges can help limit the impact if an exploitation attempt occurs, ensuring that even if a file write succeeds, it does not compromise critical system resources or sensitive data. Regular auditing of third-party dependencies and their versions is also recommended to maintain visibility over such vulnerabilities in automated build pipelines.