Security readout for executives and security teams
Plain-English summary
A malicious XML Schema can make vulnerable datamodel-code-generator versions read files outside the intended input directory and expose their contents in generated models. Secrets, configuration, or other readable data could be disclosed. The supplied sources describe confidentiality loss, not code execution or data modification.
Executive priority
Prioritize remediation for internet-facing services and automated pipelines that accept third-party schemas, especially when the process can read credentials or sensitive configuration. Upgrade promptly. Systems using only controlled schemas have lower immediate likelihood, but the vulnerable dependency should still be removed because a single malicious input can expose readable data.
Technical view
Versions 0.59.0 through 0.61.x inadequately constrain schemaLocation resolution for xs:include, xs:import, xs:redefine, and xs:override. Path traversal can access local files outside the schema base path without a remote-reference gate, with content reflected into generated output. Version 0.62.0 fixes the issue.
Likely exposure
Exposure is highest where services, CI jobs, or developer tooling process XML Schemas from untrusted or externally influenced sources. Impact depends on the files readable by that process. Installations using versions before 0.59.0, version 0.62.0 or later, or only trusted schemas are not identified as vulnerable by the supplied evidence.
Exploitation context
The CVSS 3.1 score is 7.5, reflecting remotely triggerable, low-complexity confidentiality impact without authentication or user interaction. The source bundle reports that this CVE is not in KEV and provides no evidence of active exploitation. No integrity or availability impact is claimed.
Researcher notes
The documented primitive is arbitrary local-file disclosure through insufficient schemaLocation path containment. Assess all four supported reference elements and whether generated models, logs, artifacts, or downstream systems preserve disclosed content. The supplied evidence does not establish remote-file retrieval, code execution, exploitation in the wild, or impact outside XML Schema parsing.
Mitigation direction
- Upgrade datamodel-code-generator to version 0.62.0 or later.
- Until upgraded, do not process XML Schemas from untrusted or externally controlled sources.
- Restrict the generator process to files and secrets strictly required for its function.
- Review vendor advisory and release guidance before restoring untrusted-schema processing.
Validation and detection
- Inventory datamodel-code-generator versions across services, CI pipelines, containers, and developer environments.
- Identify workflows using --input-file-type xmlschema with externally influenced schema files.
- Confirm deployed versions are 0.62.0 or later.
- Verify schema references cannot resolve outside the approved input directory after upgrading.
- Review generated artifacts and processing records for unexpected local-file content or suspicious schema references.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-610: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-55390 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6GitHub_MVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-442q-2j6p-642gCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/koxudaxi/datamodel-code-generator/commit/d2d5cecd9fd3a2a6dbf148bf0740b83a11fc6820CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.