{"metadata": {"vulnerability": "CVE-2026-55389", "count": 17, "kinds": {"milestone": 5, "sighting": 4, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-06-16T18:57:40.183Z", "date_only": false, "value": "2026-06-16T18:57:40.183Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-55389", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-28T21:49:21.260Z", "date_only": false, "value": "2026-07-28T21:49:21.260Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55389", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-28T21:49:21.260Z", "date_only": false, "value": "2026-07-28T21:49:21.260Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-55389", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-28T21:49:34Z", "date_only": false, "value": "2026-07-28T21:49:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8359-H9FX-J6V9", "record": "GHSA-8359-H9FX-J6V9", "field": "published"}, {"timestamp": "2026-07-28T21:49:34Z", "date_only": false, "value": "2026-07-28T21:49:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8359-H9FX-J6V9", "record": "GHSA-8359-H9FX-J6V9", "field": "modified"}, {"timestamp": "2026-07-28T22:17:48.400Z", "date_only": false, "value": "2026-07-28T22:17:48.400", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55389", "record": "FKIE_CVE-2026-55389", "field": "published"}, {"timestamp": "2026-07-28T22:35:06.308Z", "date_only": false, "value": "2026-07-28T22:35:06.308651Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9", "record": "CVE-2026-55389", "field": "creation_timestamp", "uuid": "16608e03-7891-4777-a402-628518aab992", "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9"}, {"timestamp": "2026-07-28T23:00:56.862Z", "date_only": false, "value": "2026-07-28T23:00:56.862390Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqjbutsj42m", "record": "CVE-2026-55389", "field": "creation_timestamp", "uuid": "d7ccf04e-1eb8-4a49-949e-fb315340af91", "content": "\ud83d\udfe0 CVE-2026-55389 - High (7.5)\n\ndatamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55389/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqjbutsj42m"}, {"timestamp": "2026-07-28T23:50:46.627Z", "date_only": false, "value": "2026-07-28T23:50:46.627434Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqm2yz35622", "record": "CVE-2026-55389", "field": "creation_timestamp", "uuid": "a0197c2e-2cdf-4205-b234-7230cc504230", "content": "CVE-2026-55389 - datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`\nCVE ID : CVE-2026-55389\n \n Published : July 28, 2026, 10:17 p.m. | 22\u00a0minutes ago\n \n Description : datam...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqm2yz35622"}, {"timestamp": "2026-07-29T10:31:22.432Z", "date_only": false, "value": "2026-07-29T10:31:22.432945Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/d0f3f961aeff39e79a8edafcd7786784", "record": "CVE-2026-55389", "field": "creation_timestamp", "uuid": "5aa9e4ed-f5c6-400e-b158-933571d79762", "content": "# CVE-2026-55389: CVE-2026-55389: Path Traversal and Security Control Bypass in datamodel-code-generator via Scheme Reference Resolution\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55389\n\n## Summary\nAn arbitrary local file read and path traversal bypass vulnerability in datamodel-code-generator before version 0.62.0 allows unauthenticated remote attackers to read arbitrary files via crafted JSON-Schema $ref references using the file:// scheme or directory traversal sequences.\n\n## TL;DR\nUnauthenticated path traversal and local file read vulnerability in datamodel-code-generator prior to 0.62.0 allowed attackers to bypass --no-allow-remote-refs using the file:// scheme or relative pathing, revealing host system file structure and secrets.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-55389\n- **Vulnerability Type**: Directory Traversal (CWE-22) / Security Control Bypass\n- **CVSS Base Score**: 7.5 (High)\n- **Attack Vector**: Network (AV:N)\n- **Affected Component**: jsonschema parser (jsonschema.py)\n- **Exploit Status**: Proof-of-Concept (PoC) documented\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- datamodel-code-generator\n- **datamodel-code-generator**: < 0.62.0 (Fixed in: `0.62.0`)\n\n## Mitigation\n\n- Upgrade to datamodel-code-generator version 0.62.0 or newer.\n- Enforce strict input validation on JSON schemas containing external $ref structures.\n- Disable parsing of untrusted user-supplied schemas in automated backend environments.\n\n**Remediation Steps:**\n1. Identify internal usages of datamodel-code-generator in dependency manifests (e.g., requirements.txt, pyproject.toml).\n2. Update the package pin to >=0.62.0.\n3. Test build pipelines to ensure schema configurations continue resolving trusted internal paths correctly.\n\n## References\n\n- [GitHub Security Advisory GHSA-8359-h9fx-j6v9](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9)\n- [Official Fix Commit on GitHub](https://github.com/koxudaxi/datamodel-code-generator/commit/2ff4a72b4550a2b2069754c5b075b1655067e5fb)\n- [PyPI Release Tag 0.62.0](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0)\n- [Project Repository](https://github.com/koxudaxi/datamodel-code-generator)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55389) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/d0f3f961aeff39e79a8edafcd7786784"}, {"timestamp": "2026-07-29T12:33:40.109Z", "date_only": false, "value": "2026-07-29T12:33:40.109394Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55389", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-29T12:33:40.109Z", "date_only": false, "value": "2026-07-29T12:33:40.109394Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55389", "record": "FKIE_CVE-2026-55389", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-29T12:33:45.388Z", "date_only": false, "value": "2026-07-29T12:33:45.388Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-55389", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-29T12:33:45.388Z", "date_only": false, "value": "2026-07-29T12:33:45.388Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55389", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-04T11:34:44.697Z", "date_only": false, "value": "2026-08-04T11:34:44.697205Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-3558", "record": "PYSEC-2026-3558", "field": "published"}, {"timestamp": "2026-08-04T13:36:15.378Z", "date_only": false, "value": "2026-08-04T13:36:15.378101Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-3558", "record": "PYSEC-2026-3558", "field": "modified"}, {"timestamp": "2026-08-06T19:44:40.270Z", "date_only": false, "value": "2026-08-06T19:44:40.270", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55389", "record": "FKIE_CVE-2026-55389", "field": "lastModified"}]}