CyberRota Analysis
AI-GeneratedThe vulnerability in the datamodel-code-generator affects versions 0.59.0 to 0.62.0, allowing attackers to exploit XML Schema parsing to read arbitrary local files by resolving schemaLocation values outside the input base path. This can lead to unauthorized access to sensitive information reflected in the generated Python data models. Organizations using affected versions should prioritize upgrading to version 0.62.0 to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0.