CVE-2026-55390 affects the datamodel-code-generator Python library, which generates data models from schema definitions. Versions 0.59.0 through 0.62.0 are vulnerable to an arbitrary file read issue in the XML Schema parsing component. The vulnerability arises because xs:include, xs:import, xs:redefine, and xs:override schemaLocation values are resolved outside the intended input base path. This allows attackers to craft malicious XML schema files that cause the tool to read arbitrary local files. The contents of those files are then reflected into generated Python models, potentially exposing sensitive data. The affected code resides in src/datamodel_code_generator/parser/xmlschema.py and is triggered via the --input-file-type xmlschema flag. The vulnerability has been patched in version 0.62.0. Users are advised to upgrade immediately to mitigate the risk of local file disclosure.