CyberRota Analysis
AI-GeneratedThe datamodel-code-generator prior to version 0.62.0 is vulnerable to arbitrary local file reads due to improper handling of JSON Schema $ref targets, which can be exploited through crafted input. This vulnerability poses a significant risk as it may allow attackers to access sensitive local files on the system. Organizations using this tool for generating data models should prioritize upgrading to version 0.62.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)