datamodel-code-generator Path Traversal in Protobuf Weak Imports (CVE-2026-107377)

Vulnerability Overview Vulnerability Name: Protobuf weak-import path traversal allows files to be written outside the temporary directory CVE ID: CVE-2026-107377 CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None Vulnerability Description: When processing attacker-controlled Protobuf schemas, affected versions of may write generated Protobuf syntax stubs outside the intended temporary directory. Absolute import paths and relative import paths containing can escape this directory. Attackers can create directories and new files in writable locations. Relative path traversal can also overwrite existing files because the existence check and file write operations use different base directories. Affected Versions Affected Versions: >= 0.59.0, <= 0.80.0 Fixed Version: 0.81.0 Impact: Any user or CI pipeline running an affected version of against untrusted Protobuf schemas may be exposed to arbitrary file/directory creation and overwriting. Specific harms include overwriting source files, configuration files, files, lock files, files, entry point files, etc., leading to project corruption, build failures, and denial of service. Creation of arbitrary directory trees or placement of files in monitored or auto-loaded locations. Mitigation Remediation Measures: The fix has been merged into the branch of the parent repository (commit: 5e84b8f). The Protobuf input preprocessor now parses the dedicated temporary weak import directory and each candidate stub file path. If a parsed candidate is outside this directory, it raises a before checking the canonical path, creating parent directories, or writing the stub. Input preparation failures now immediately clean up the temporary directory. User Actions: Users should upgrade to version 0.81.0 or higher. Proof of Concept (POC) References GHSA-8359-h9fx-pv7j / CVE-2026-55389 GHSA-t426-26p-f42y / CVE-2026-55390 Python pathlib - PurePath._truevalue_ Discovery Discovered via source code review and reproducible POC in versions 0.80.0 and main (commit: 8347315b6dc90c182a9919f316069cf9ff6059a, September 2026). Patch Fixed version 0.81.0 has been released. Users should upgrade to version 0.81.0 or higher.

Goal Reached Thanks to every supporter — we hit 100%!

datamodel-code-generator Path Traversal in Protobuf Weak Imports (CVE-2026-107377)

More from this source