CVE-2026-107377 datamodel-code-generator CVE debrief

Who should care

Users of `datamodel-code-generator` library, especially those processing attacker-controlled Protobuf schemas, should assess their exposure and update to version 0.81.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the affected scope, severity, and vendor guidance.

Why it matters

A vulnerability in `datamodel-code-generator` allows an attacker to write files outside the intended temporary directory when processing an attacker-controlled Protobuf schema. This could lead to the creation of directories and files at locations writable by the process, potentially overwriting existing files. Users should assess their exposure and update to version 0.81.0 or later.

• Potential for unauthorized file creation and modification
• Possible overwriting of existing files
• Filesystem side effects before `protoc` compilation

Technical summary

The `datamodel-code-generator` library is vulnerable to a path traversal attack when processing Protobuf schemas. An attacker could create directories and files outside the intended temporary directory, potentially overwriting existing files. The vulnerability is caused by a weak-import path traversal issue in `datamodel-code-generator`. An attacker-controlled Protobuf schema can be used to write a generated weak-import stub outside the intended `__weak_imports__` temporary directory. Absolute import paths and relative paths containing `..` could escape this directory. This issue did not provide fully attacker-controlled file contents, and direct arbitrary code execution has not been demonstrated.

Defensive priority

High

Recommended defensive actions

• Assess exposure of `datamodel-code-generator` usage in your environment
• Verify if vulnerable versions are in use and update to version 0.81.0 or later
• Monitor for potential file system side effects
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a weak-import path traversal issue in `datamodel-code-generator`. An attacker-controlled Protobuf schema can be used to write a generated weak-import stub outside the intended `__weak_imports__` temporary directory. Absolute import paths and relative paths containing `..` could escape this directory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.