An insecure reference resolution routine in datamodel-code-generator allows a malicious JSON Schema to specify local files to be read via file:// URLs or directory traversal (../). When the tool processes such a schema, it reads the referenced file without checking its location or honoring the --no-allow-remote-refs flag, exposing any file readable by the running process to disclosure of sensitive data such as configuration files, keys, or source code.

The affected product is datamodel-code-generator from koxudaxi. All releases before version 0.62.0 are impacted, while 0.62.0 and newer contain the fix that removes the unsafe reference handling.

The CVSS score of 7.5 classifies the vulnerability as moderately high severity. The EPSS score of less than 1% indicates a low probability of exploitation at the time of assessment, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker would need to supply a malicious JSON Schema to the tool, possibly through a local automation script or a compromised local service that processes user‑supplied schemas. The likely attack requires local execution or privileges that allow the attacker to influence the schema file; remote exploitation without additional compromise is unlikely. The flaw reduces confidentiality by permitting arbitrary local file reads, scoped to the permissions of the running process.