{"id":"CVE-2026-107377","published":"2026-10-08T18:17:22.973","lastModified":"2026-10-14T02:16:56.650","description":"datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-22","CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc","tags":[]},{"url":"https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0","tags":[]},{"url":"https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c","tags":[]},{"url":"https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c","tags":[]}],"exploitRefs":[{"url":"https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc","tags":[]},{"url":"https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0","tags":[]},{"url":"https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c","tags":[]},{"url":"https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c","tags":[]}],"hasPoc":true,"ai":{"summary":"A path traversal vulnerability in datamodel-code-generator allows attackers to write ProtoBuf schema files outside of designated directories, potentially creating or overwriting files with proto syntax declarations. This could lead to persistent modifications in the target system's file structure.","exploitability":"Exploitation requires a victim or automated job to process an attacker-controlled Protobuf schema with grpcio-tools package, making it moderately difficult but possible to achieve with proper targeting of vulnerable systems.","blast_radius":"The impact is limited to file creation or overwrites in writable locations, but could be significant if the processing occurs in sensitive directories like configuration or deployment areas.","remediation":"Upgrade to version 0.81.0 or later to fix the path traversal vulnerability in Protobuf schema processing.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","protobuf","code-generation"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:25:25.264Z"}}