Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M
CVE-2026-107377datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
High 7.5
In plain English
A high-severity path traversal in datamodel-code-generator from datamodel-code-generator. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | datamodel-code-generator | 0.81.0 | GHSA-77xj-x4rm-935c |
| PyPI | datamodel-code-generator | 0.81.0 | PYSEC-2026-4205 |
| Ubuntu:26.04:LTS | python-datamodel-code-generator | no fix listed | UBUNTU-CVE-2026-107377 |
| Ubuntu:26.10 | python-datamodel-code-generator | no fix listed | UBUNTU-CVE-2026-107377 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| datamodel-code-generator | datamodel-code-generator | >= 0.59.0, < 0.81.0 |
Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c x_refsource_CONFIRM
- https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc x_refsource_MISC
- https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0 x_refsource_MISC