CVE-2026-55389: Path Traversal and Security Control Bypass in datamodel-code-generator via Scheme Reference Resolution

The Python package datamodel-code-generator parses structured schemas like JSON Schema, OpenAPI, and GraphQL to automatically generate Pydantic models, dataclasses, or TypedDict implementations.

To facilitate modular schema design, the package supports the $ref keyword, allowing references to external definitions located either locally or remotely.

Security controls like the --no-allow-remote-refs command-line flag were designed to restrict the parser from retrieving external resources.

However, a directory traversal and security bypass flaw in the reference resolution subsystem allowed attackers to access local files readable by the process user.

The vulnerability originates from two design flaws within the reference parser found in src/datamodel_code_generator/parser/jsonschema.py.

First, the validator functions defined in reference.py improperly categorized the file:// scheme as a valid URL via the is_url helper function.

Due to this classification, absolute file paths using the file:// scheme bypassed remote reference verification mechanisms even when --no-allow-remote-refs was enabled.

Second, the local file resolver failed to enforce strict directory sandboxing. This omission allowed absolute paths and relative directory traversal paths containing ../ to resolve outside the intended root directory.

Prior to the patch, the is_url validator evaluated references using a simple prefix match:

# Vulnerable implementation of is_url in reference.py
def is_url(ref: str) -> bool:
    return ref.startswith(("https://", "http://", "file://"))

In _get_ref_body, the parser evaluated the reference, granting an exception to the file:// prefix when applying remote-ref blocks:

# Vulnerable path in jsonschema.py
if is_url(resolved_ref):
    if not resolved_ref.startswith("file://") and self.http_local_ref_path is None:
        if self.allow_remote_refs is False:
            raise Error(...) # Bypassed for file:// schemes

Because of this logic, file:// schemas completely bypassed security boundaries and reached the underlying file retrieval handler. Additionally, relative references were concatenated directly without standard verification:

# Relative traversal without containment check
full_path = self.base_path / resolved_ref

The patch in commit 2ff4a72b4550a2b2069754c5b075b1655067e5fb remediates this by introducing _resolve_local_ref_path, which uses Python's pathlib.Path.resolve and is_relative_to to enforce a strict boundary check.

An attacker can exploit this flaw by submitting a crafted JSON Schema containing standard $ref pointers. If the application exposes code-generation capabilities through an API endpoint, exploitation can be performed remotely and without credentials.

An attacker can use the parser as a file-system oracle to identify valid system paths. If a target file exists, the parser attempts to parse it and returns a TypeError: Expected dict, got str error, whereas a missing file triggers a FileNotFoundError.

If the targeted files contain structured YAML or JSON definitions, such as internal configurations or keys, the generator includes the extracted data directly in the output models.

The vulnerability has been assigned a CVSS v3.1 score of 7.5, indicating high severity due to high confidentiality exposure. Successful exploitation allows unauthorized access to sensitive application source code, container configurations, and local credentials.

Because the component is frequently executed within build pipelines or automated backends, this compromise can lead to broader access to deployment environments.

There is no integrity or availability impact, as the attacker cannot write to or alter local filesystem contents via this vector.

Users should update datamodel-code-generator to version 0.62.0 or higher immediately to resolve this security control bypass.

In version 0.62.0, the generator implements a strict boundary validator _resolve_local_ref_path that denies requests targeting paths outside the initialized input base path.

If upgrading is not immediately possible, validate input schemas before processing to remove $ref statements pointing to external URLs or paths with directory traversal sequences.