Directory Traversaldatamodel-code-generator is a Datamodel Code Generator
Affected versions of this package are vulnerable to Directory Traversal via the resolution of JSON-Schema $ref references that point to local files using either file:// URIs or ../-escaped relative paths, without restricting access to the input or base directory and bypassing the intended security control. An attacker can access arbitrary files on the filesystem and disclose sensitive information by submitting a crafted schema that references files outside the intended directory.
Note: This is only exploitable if the application processes untrusted schemas provided by external users.
How to fix Directory Traversal? Upgrade datamodel-code-generator to version 0.62.0 or higher.
| |
Exposure of Private Personal Information to an Unauthorized Actordatamodel-code-generator is a Datamodel Code Generator
Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor via the get_body function. An attacker can obtain sensitive authorization headers by causing a redirect to a different origin, resulting in the disclosure of credentials to an unauthorized host.
How to fix Exposure of Private Personal Information to an Unauthorized Actor? Upgrade datamodel-code-generator to version 0.63.0 or higher.
| |
Directory Traversaldatamodel-code-generator is a Datamodel Code Generator
Affected versions of this package are vulnerable to Directory Traversal via the schemaLocation attribute in XSD processing. An attacker can access arbitrary files on the local filesystem by supplying a crafted XML Schema file that uses relative or absolute paths in the schemaLocation attribute, causing the process to read files outside the intended directory and incorporate their contents into the generated output.
How to fix Directory Traversal? Upgrade datamodel-code-generator to version 0.62.0 or higher.
| |
Server-side Request Forgery (SSRF)datamodel-code-generator is a Datamodel Code Generator
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the get_body function when processing URLs provided via the --url argument, as there is no validation of host or IP addresses and redirects are followed unconditionally. An attacker can access internal network resources and exfiltrate sensitive information by supplying a crafted URL that redirects to internal or cloud metadata endpoints, causing their responses to be embedded in generated source files.
Note: This is only exploitable if the [http] extra is installed and the tool is run with an untrusted or attacker-controlled URL.
How to fix Server-side Request Forgery (SSRF)? Upgrade datamodel-code-generator to version 0.61.0 or higher.
| |
Server-side Request Forgery (SSRF)datamodel-code-generator is a Datamodel Code Generator
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the get_body function, which performs DNS resolution validation separately from the actual HTTP connection. An attacker can access internal network resources and potentially retrieve sensitive information by exploiting a DNS rebinding technique that causes the validated hostname to resolve to a public IP during validation and a private/internal IP during connection. This allows bypassing of network access controls and may result in exposure of internal services or credentials.
How to fix Server-side Request Forgery (SSRF)? Upgrade datamodel-code-generator to version 0.63.0 or higher.
| |
Server-side Request Forgery (SSRF)datamodel-code-generator is a Datamodel Code Generator
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the process that handles dereferencing JSON-Schema $ref values pointing to HTTP or HTTPS URLs without proper IP or host validation, scheme allow-list, or redirect restrictions. An attacker can access internal network resources and leak sensitive information into generated code by supplying a crafted JSON-Schema or OpenAPI document containing malicious $ref URLs. This is only exploitable if the [http] extra is installed.
How to fix Server-side Request Forgery (SSRF)? Upgrade datamodel-code-generator to version 0.61.0 or higher.
| |
Eval Injectiondatamodel-code-generator is a Datamodel Code Generator
Affected versions of this package are vulnerable to Eval Injection via unsanitized input in the from_full_path and create_line functions. An attacker can execute arbitrary code at import time by supplying malicious schema extensions that inject statements into generated import lines.
How to fix Eval Injection? Upgrade datamodel-code-generator to version 0.64.0 or higher.
| |
Arbitrary Code Injectiondatamodel-code-generator is a Datamodel Code Generator
Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a dot-free Python expression, which is inserted verbatim into a generated import statement without proper validation. This code is then executed when the generated module is imported.
How to fix Arbitrary Code Injection? Upgrade datamodel-code-generator to version 0.70.0 or higher.
| |
