The datamodel-code-generator tool, used to generate Python data models from schema definitions, contains a path traversal vulnerability (CWE-22) in its XML Schema parsing component (src/datamodel_code_generator/parser/xmlschema.py) when processing --input-file-type xmlschema. Specifically, from versions 0.59.0 up to but not including 0.62.0, the parser resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation attributes without restricting them to the input base path. This allows an attacker to cause the tool to read arbitrary local files and reflect their contents into the generated models. The vulnerability is tracked as CVE-2026-55390 with a CVSS 3.1 score of 7.5 (high severity). The issue is fixed starting with version 0.62.0.

An attacker can exploit this vulnerability to read arbitrary local files on the system where datamodel-code-generator is run, potentially exposing sensitive information. The vulnerability does not affect integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

Upgrade datamodel-code-generator to version 0.62.0 or later, where this path traversal vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the fixed version 0.62.0.