Skip to content
Heist/ feed
High

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Type: advisorySource: Official CVE List1 source record

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0.

Announced Source revision 1
Original source ↗

CVE-2026-107377

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-107377

datamodel-code-generator

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "datamodel-code-generator",
    "product": "datamodel-code-generator",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.59.0, < 0.81.0"
      }
    ]
  }
]
Related CVEs
CVE-2026-107377

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#21329 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement