CVE-2026-107377

Summary

Affected component

• Repository: datamodel-code-generator/datamodel-code-generator (formerly koxudaxi/datamodel-code-generator).
• Analyzed at: released 0.80.0 (pip install datamodel-code-generator==0.80.0) and main @ commit 834731d56c0a90c182a0919f316069cf5ff0659a (2026-09-13). Both contained the identical vulnerable sink.
• Sink / entry point (src/datamodel code generator/parser/protobuf.py, line numbers from 0.80.0):
• Source: WEAK IMPORT PATTERN (protobuf.py:37) — attacker-controlled capture group.
• Sink: write missing weak imports (protobuf.py:391-393) — weak import dir / import path + mkdir(parents=True) + write text.
• Timing: called from ProtoInputPreparer. enter (protobuf.py:333), before protoc.main(...) runs inside the with body.
• Preconditions: victim runs the tool (CLI or Python API) with --input-file-type protobuf on an attacker-controlled .proto, supplied as a local file (--input) or a remote URL (--url). Requires the grpcio-tools package (Protobuf support). The attacker does not need privileges on the affected system; filesystem effects are limited to locations writable by the code-generation process.

Severity

• Scored to match the project's own rating of the sibling path-traversal advisories CVE-2026-55389 / CVE-2026-55390, both AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5. This finding is the same attack surface (unvalidated path from a processed schema) with the impact moved from confidentiality (read) to integrity (write), hence C:N/I:H.
• AV:N: the malicious schema can be fetched over the network via --url, consistent with how the siblings were scored.
• I:H: attacker fully controls the write path and can create arbitrary directory trees and overwrite existing files; only the file content is constrained (a fixed syntax = "proto{2,3}"; line).
• A:N chosen conservatively; overwriting build-critical files (lock files, init .py, entry points) can cause availability loss, which would argue A:L.
• Honest alternative: if the reviewer treats "the victim must run the tool on the file" as user interaction (UI:R), the score is 6.5 (Moderate). The project used UI:N for the identical read-path siblings, so UI:N is used here for consistency.

Details

# protobuf.py:37
WEAK IMPORT PATTERN = re.compile(r'^s*imports+weaks+"([^"]+)"s*;', re.MULTILINE)

# protobuf.py:383-393 ( write missing weak imports)
for import path in WEAK IMPORT PATTERN.findall(text):
  if any((include path / import path).exists() for include path in include paths):
    continue
  stub = self.weak import dir / import path    # no resolve(), no is relative to()
  stub.parent.mkdir(parents=True, exist ok=True)  # arbitrary directory tree
  stub.write text(syntax, encoding=self.parser.encoding)

• Absolute path: Path(".../ weak imports ") / "/etc/x" == /etc/x (an absolute right operand replaces the base). Creates new files anywhere the process can write.
• ../ traversal: Path(".../ weak imports ") / "../../x" climbs out of the temp directory.

Attack path

1. Attacker crafts evil.proto containing e.g. import weak "/home/victim/.config/x"; and/or import weak "../../overwrite me.txt";, and gets the victim to process it (third-party schema, or --url to an attacker-hosted file).
2. write missing weak imports writes the stub to the attacker-chosen path, creating any intermediate directories and overwriting an existing file (relative case).
3. protoc then fails, but the file(s) are already on disk.

Proof of Concept

[*] installed version: 0.80.0
[test A] absolute-path arbitrary file + mkdir(parents):
 [PASS] new file created at attacker-controlled absolute path
 [PASS] content is the fixed syntax stub
[test B] relative-traversal overwrite of pre-existing file:
 [PASS] pre-existing victim.txt content was overwritten
 [PASS] victim.txt now holds the injected stub
==================== RESULT: 4 passed, 0 failed ====================

[*] serving malicious proto at http://127.0.0.1:<port>/evil url.proto
 [PASS] server actually served the proto (HTTP 200)
 [PASS] absolute-path arbitrary file created
 [PASS] pre-existing victim overwritten via ../
==================== RESULT: 3 passed, 0 failed ====================

Impact

• Overwrite source, config, .env, lock files, or init .py / entry-point files → project corruption, broken builds, denial of service.
• Create arbitrary directory trees / drop files into watched or auto-loaded locations.

Resolution

• rejection of absolute weak-import paths outside the sandbox;
• rejection of relative .. traversal outside the sandbox;
• preservation of a pre-existing file outside the sandbox.

References

• GHSA-8359-h9fx-j6v9 / CVE-2026-55389 — datamodel-code-generator arbitrary local file read via JSON-Schema $ref path traversal (CWE-22/200/610, 7.5, patched 0.62.0). Same class, read primitive; sibling entry point.
• GHSA-442q-2j6p-642g / CVE-2026-55390 — datamodel-code-generator arbitrary local file read via XSD schemaLocation path traversal (CWE-22/200/610, 7.5, affected >= 0.59.0, <= 0.61.0, patched 0.62.0). Same class, read primitive; the fix sweep that missed the Protobuf entry point.
• Python pathlib — PurePath. truediv : an absolute right-hand operand discards the left operand; .. segments are not normalized. (https://docs.python.org/3/library/pathlib.html)

Discovery