datamodel-code-generator Vulnerable to Arbitrary Local File Read
An early warning indicates that the datamodel-code-generator package is reportedly vulnerable to arbitrary local file read via XSD schemaLocation path traversal, potentially affecting multiple versions.
What happened
The datamodel-code-generator package appears to be vulnerable to an unauthenticated path-traversal issue that could allow an attacker to read arbitrary local files. This vulnerability is reachable in the default configuration and affects various versions of the package. It is recommended to monitor for updates and consider restricting input sources or implementing additional validation checks to mitigate potential risks.
How 0Day mitigates this
datamodel-code-generator is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.