VulnSocial

CVE-2026-55390Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22CWE-200CWE-610

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-29); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-06-23: 1Mentions · 2026-07-29: 2Mentions · 2026-08-01: 1Patch / Workaround · 2026-08-01: 1Technical Details · 2026-07-29: 1Technical Details · 2026-08-01: 106-2307-2908-01
Signal classification3 categories
Disclosure
250.0%
General
125.0%
Patch
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-231
General1
2026-07-292
Disclosure2
2026-08-011
Patch1
Full discourse4 posts
  • Hamza@TheGr1ffyn
    General

    CVE-2026-54621 CVE-2026-54653 CVE-2026-54654 CVE-2026-54655 CVE-2026-54656 CVE-2026-54690 CVE-2026-54691 CVE-2026-55415 CVE-2026-55389 CVE-2026-55390 CVE-2026-55391 CVE-2026-55403

    Post summary

    The provided text lists a series of CVE identifiers but contains no additional context, such as PoC, exploit details, active exploitation, patches, or technical descriptions.

    1000061
    132 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-55390 - High severity path traversal in datamodel-code-generator 0.59.0-0.62.0. Arbitrary local file read via XML schema imports. CVSS 7.5. Update to 0.62.0 immediately. #CVE #Python #infosec #redteam #blueteam #cybersecurity #cybersecuritytips #cybersecuritynews #git #github #gitlab #developer #developers #linux #docker #100daysofcybersecurity https://www.valtersit.com/cve/CVE-2026-55390/

    Post summary

    The post reports CVE‑2026‑55390 as a high‑severity path traversal in datamodel‑code‑generator, recommends updating to version 0.62.0, and provides technical details but no active exploitation or PoC.

    0000052
    978 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-55390 datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xml… https://www.cve.org/CVERecord?id=CVE-2026-55390 ----- Traducción: CVE-2026-55390 dat… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-55390, noting affected versions of datamodel-code-generator and the affected XML schema parsing component, with a link to the official CVE record.

    0000030
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-55390 datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xml… https://www.cve.org/CVERecord?id=CVE-2026-55390

    Post summary

    The message announces the discovery of CVE‑2026‑55390 affecting datamodel‑code‑generator, specifying vulnerable version range and file, but provides no PoC, exploit, or mitigation details.

    00000993
    57.9K followersView on X

Explore more

Back to dashboard