Description
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code execution has not been demonstrated. This issue is fixed in version 0.81.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| datamodel-code-generator | datamodel-code-generator | >= 0.59.0, < 0.81.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-datamodel-code-generator | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-datamodel-code-generator | 0.83.0-1.1 | openSUSE-SU-2026:12096-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | datamodel-code-generator | >= 0.59.0, < 0.81.0 | 0.81.0 | GHSA-77xj-x4rm-935c |
Advisories 1
- openSUSE-SU-2026:12096-1 python313-datamodel-code-generator-0.83.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 10, 2026
References
- https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c
- https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc
- https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0