| Title | datamodel-code-generator <= 0.80.0 Information Disclosure |
|---|
| Description | Summary:
datamodel-code-generator recursively resolves $ref in untrusted schemas. When $ref uses the file:// scheme or resolves to a path outside the base_path, the default configuration (allow_remote_refs=None) only emits a FutureWarning and returns the path. Subsequently, _get_ref_body_from_url reads the local file and loads it as a schema, leading to sensitive file disclosure. This is exploitable in the default configuration.
Details:
Root cause: Input schemas are treated as semi-trusted but are actually attacker-controlled data. The $ref resolver only warns when the target local file is outside base_path.
Entry point: CLI loads schema via --input/--url; parser uses config.allow_remote_refs, defaulting to None (base_config.py:172, config.py:229).
Dispatch: _resolve_ref (jsonschema.py:11114) calls _get_ref_body; _validate_external_ref (jsonschema.py:821) only rejects multi-hash references.
Scheme acceptance: is_url (reference.py:1869) accepts file://; in _get_ref_body (jsonschema.py:10924-10950) the default None only warns.
Sink: _get_ref_body_from_url (jsonschema.py:11067-11083).
Trust boundary failure: _resolve_local_ref_path (jsonschema.py:10970-10998) only warns and returns resolved_path when the path is outside base_path and allow_remote_refs is None.
Core vulnerable code path:
def _resolve_local_ref_path(self, path: Path, ref: str) -> Path:
base_path = self.base_path.resolve()
resolved_path = path.resolve()
if resolved_path.is_relative_to(base_path) or self.allow_remote_refs is True:
self._local_ref_path_cache[path] = resolved_path
return resolved_path
if self.allow_remote_refs is None:
warn_deprecated("behavior.remote-ref-default", details=details, stacklevel=3)
return resolved_path
raise Error(msg)
PoC:
Prerequisite: Victim runs datamodel-codegen on an attacker-controlled schema in the default configuration.
Steps:
1. Create a schema with a property $ref pointing to file:///etc/hostname or ../../../../../../etc/hostname.
2. Run: datamodel-codegen --input schema.json --input-file-type jsonschema --output out.py
3. A FutureWarning is expected, and the local file is read and echoed in the output.
4. Remote variant: A remote schema containing $ref file:///etc/passwd.
5. Verify blocking with --no-allow-remote-refs (opt-in).
No authentication required.
Impact:
In the default configuration, an untrusted schema can cause the tool to read any readable local file on the host. The content is echoed via generated models or parsing errors, leaking credentials and configuration. The primary impact is on confidentiality.
Remediation:
1. Change the default value of allow_remote_refs to False or introduce a default-deny policy.
2. For remote/untrusted documents, forbid the file:// scheme and enforce convergence within base_path.
3. Keep --allow-remote-refs as an explicit opt-in.
4. Update documentation and add regression tests.
Disclosure Notes:
Affected version: 0.80.0. This finding has been dynamically verified. Patched versions: to be confirmed. |
|---|
| Source | ⚠️ https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-4chw-mcgg-3j6q |
|---|
| User | yuechuya (UID 101209) |
|---|
| Submission | 09/13/2026 20:49 (28 days ago) |
|---|
| Moderation | 10/11/2026 16:41 (28 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 384028 [koxudaxi datamodel-code-generator up to 0.61.x JSON Schema Parser jsonschema.py _get_ref_body path traversal] |
|---|
| Points | 0 |
|---|