CVE-2026-107377: datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

## Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of `datamodel-code-generator` could write a generated weak-import stub outside the intended `__weak_imports__` temporary directory. Absolute import paths and relative paths containing `..` could escape this directory. An attacker could create directories and new files at locations writable by the process. Relative path traversal could also overwrite existing writable files because the existence check and the stub write used different base directories. An existing absolute target was skipped by the existence check. Written content was limited to a generated Protobuf syntax declaration, `syntax = "proto2";` or `syntax = "proto3";`, followed by a newline. This issue did not provide fully attacker-controlled file contents, and direct arbitrary code execution has not been demonstrated. These filesystem side effects occurred before `protoc` ran. A subsequent compilation error did not undo them. A user or CI job must process the attacker-controlled schema for the issue to be triggered, whether the schema is supplied as a local file or fetched via `--url`. The fix has been merged into the parent repository's `main` branch in [5e94b8f](https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc). A patched package release is not yet available. The technical details and PoC below describe the vulnerable implementation before that fix. ## Affected component - Repository: `datamodel-code-generator/datamodel-code-generator` (formerly `koxudaxi/datamodel-code-generator`). - Analyzed at: released **0.80.0** (`pip install datamodel-code-generator==0.80.0`) and `main` @ commit `834731d56c0a90c182a0919f316069cf5ff0659a` (2026-09-13). Both contained the identical vulnerable sink. - Sink / entry point (`src/datamodel_code_generator/parser/protobuf.py`, line numbers from 0.80.0): - Source: `WEAK_IMPORT_PATTERN` (`protobuf.py:37`) — attacker-controlled capture group. - Sink: `_write_missing_weak_imports` (`protobuf.py:391-393`) — `weak_import_dir / import_path` + `mkdir(parents=True)` + `write_text`. - Timing: called from `_ProtoInputPreparer.__enter__` (`protobuf.py:333`), before `protoc.main(...)` runs inside the `with` body. - Preconditions: victim runs the tool (CLI or Python API) with `--input-file-type protobuf` on an attacker-controlled `.proto`, supplied as a local file (`--input`) or a remote URL (`--url`). Requires the `grpcio-tools` package (Protobuf support). The attacker does not need privileges on the affected system; filesystem effects are limited to locations writable by the code-generation process. ## Severity Proposed: **High**. `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` = **7.5**. - Scored to match the project's own rating of the sibling path-traversal advisories CVE-2026-55389 / CVE-2026-55390, both `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` = 7.5. This finding is the same attack surface (unvalidated path from a processed schema) with the impact moved from confidentiality (read) to **integrity (write)**, hence `C:N/I:H`. - `AV:N`: the malicious schema can be fetched over the network via `--url`, consistent with how the siblings were scored. - `I:H`: attacker fully controls the write path and can create arbitrary directory trees and overwrite existing files; only the file *content* is constrained (a fixed `syntax = "proto{2,3}";` line). - `A:N` chosen conservatively; overwriting build-critical files (lock files, `__init__.py`, entry points) can cause availability loss, which would argue `A:L`. - Honest alternative: if the reviewer treats "the victim must run the tool on the file" as user interaction (`UI:R`), the score is **6.5 (Moderate)**. The project used `UI:N` for the identical read-path siblings, so `UI:N` is used here for consistency. ## Details Source pattern — the imported path is captured with no character restriction: ```python # protobuf.py:37 WEAK_IMPORT_PATTERN = re.compile(r'^\s*import\s+weak\s+"([^"]+)"\s*;', re.MULTILINE) ``` Sink — the captured path is joined and written with no boundary check: ```python # protobuf.py:383-393 (_write_missing_weak_imports) for import_path in WEAK_IMPORT_PATTERN.findall(text): if any((include_path / import_path).exists() for include_path in include_paths): continue stub = self.weak_import_dir / import_path # no resolve(), no is_relative_to() stub.parent.mkdir(parents=True, exist_ok=True) # arbitrary directory tree stub.write_text(syntax, encoding=self.parser.encoding) ``` Two escape mechanisms, both from `pathlib`'s `/` semantics: - **Absolute path**: `Path(".../__weak_imports__") / "/etc/x"` == `/etc/x` (an absolute right operand replaces the base). Creates new files anywhere the process can write. - **`../` traversal**: `Path(".../__weak_imports__") / "../../x"` climbs out of the temp directory. Why the existence guard (line 389) does not protect the write: it checks `include_path / import_path`, using a **different base** (`include_paths`) than the actual write, which uses `self.weak_import_dir / import_path`. For a *relative* path the two bases resolve to different directories, so the guard checks a location that is not the real write target and misses it — enabling **overwrite of existing files**. (For an absolute path the guard and the write coincide, so an already- existing absolute target is skipped; absolute paths thus create new files but do not overwrite. Overwrite is reached via the relative-traversal path.) Timing: `_write_missing_weak_imports` runs inside `__enter__` (line 333), and `protoc.main(...)` runs later in the `with` body. `protoc` rejects the malformed virtual path (`Backslashes, consecutive slashes, "." or ".." are not allowed in the virtual path`) and the overall command exits non-zero — but the file has already been written; the filesystem side effect is not rolled back. ### Attack path 1. Attacker crafts `evil.proto` containing e.g. `import weak "/home/victim/.config/x";` and/or `import weak "../../overwrite_me.txt";`, and gets the victim to process it (third-party schema, or `--url` to an attacker-hosted file). 2. `_write_missing_weak_imports` writes the stub to the attacker-chosen path, creating any intermediate directories and overwriting an existing file (relative case). 3. `protoc` then fails, but the file(s) are already on disk. ## Proof of Concept Two self-contained scripts (`poc/reproduce.sh` for `--input`, `poc/reproduce-url.sh` for `--url`) install the released `datamodel-code-generator==0.80.0`, serve/point a malicious `.proto`, and assert the writes. The PoC drives the **released** package unmodified; the sink file's sha256 is recorded in `REPRODUCE.md`. Local `--input` run against 0.80.0 — real output: ``` [*] installed version: 0.80.0 [test A] absolute-path arbitrary file + mkdir(parents): [PASS] new file created at attacker-controlled absolute path [PASS] content is the fixed syntax stub [test B] relative-traversal overwrite of pre-existing file: [PASS] pre-existing victim.txt content was overwritten [PASS] victim.txt now holds the injected stub ==================== RESULT: 4 passed, 0 failed ==================== ``` Remote `--url` run against 0.80.0 — real output (proto served over HTTP, then the same writes fire): ``` [*] serving malicious proto at http://127.0.0.1:<port>/evil_url.proto [PASS] server actually served the proto (HTTP 200) [PASS] absolute-path arbitrary file created [PASS] pre-existing victim overwritten via ../ ==================== RESULT: 3 passed, 0 failed ==================== ``` ## Impact Any user or CI pipeline that runs an affected version of `datamodel-code-generator` on an untrusted Protobuf schema (a downloaded third-party `.proto`, or `--url` to a remote source) is exposed to arbitrary file/directory creation and overwrite by the schema author, with the process's own permissions. Concrete harms: - Overwrite source, config, `.env`, lock files, or `__init__.py` / entry-point files → project corruption, broken builds, denial of service. - Create arbitrary directory trees / drop files into watched or auto-loaded locations. Direct arbitrary code execution has not been demonstrated. The written content is limited to a generated `syntax = "proto2";` or `syntax = "proto3";` line and is not fully attacker-controlled. ## Resolution The fix was merged into the parent repository's `main` branch in [5e94b8f](https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc). The Protobuf input preparer now resolves the dedicated temporary weak-import directory and each candidate stub path. If a resolved candidate is outside that directory, it raises `SchemaParseError` before checking include paths, creating parent directories, or writing the stub. The containment check rejects absolute-path escapes and relative `..` traversal that would leave the sandbox. Input-preparation failures also immediately clean up the temporary directory. Regression tests cover: - rejection of absolute weak-import paths outside the sandbox; - rejection of relative `..` traversal outside the sandbox; - preservation of a pre-existing file outside the sandbox. Local tox validation of the patch passed across the Python 3.10–3.14 and formatter matrix, the CI compatibility environments, and the repository checks. Combined line and branch coverage, including the changed files, reached 100%. A fixed package has not yet been published to PyPI; the latest published version at the time of this update is 0.80.0. `Patched versions` remains unset until a release containing this fix is available. The advisory remains private pending that release. ## References - GHSA-8359-h9fx-j6v9 / CVE-2026-55389 — datamodel-code-generator arbitrary local file **read** via JSON-Schema `$ref` path traversal (CWE-22/200/610, 7.5, patched 0.62.0). Same class, read primitive; sibling entry point. - GHSA-442q-2j6p-642g / CVE-2026-55390 — datamodel-code-generator arbitrary local file **read** via XSD `schemaLocation` path traversal (CWE-22/200/610, 7.5, affected `>= 0.59.0, <= 0.61.0`, patched 0.62.0). Same class, read primitive; the fix sweep that missed the Protobuf entry point. - Python `pathlib` — `PurePath.__truediv__`: an absolute right-hand operand discards the left operand; `..` segments are not normalized. (https://docs.python.org/3/library/pathlib.html) ## Discovery Found via source review and a reproducing PoC on `datamodel-code-generator/datamodel-code-generator`, released 0.80.0 and `main` @ `834731d56c0a90c182a0919f316069cf5ff0659a`, 2026-09.