CVE-2026-108375: high-severity vulnerability in marcosschroh dataclasses-avroschema
dataclasses-avroschema allows code injection through generated field-default literals
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.5%
exploitation probability
0.5%top 60% of all CVEs
observed exploitation
nono source reports it
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
marcosschroh · dataclasses-avroschemaRelated CVEs — marcosschroh dataclasses-avroschema
In the same product, most dangerous first.
CVE-2026-108376HIGHdataclasses-avroschema allows code injection through record names in generated default factoriesEPSS 0.5%CVE-2026-108380HIGHdataclasses-avroschema field documentation allows code injection in generated Pydantic descriptionsEPSS 0.4%CVE-2026-108381HIGHdataclasses-avroschema pydantic-class metadata allows code injection in generated annotationsEPSS 0.4%CVE-2026-108377HIGHdataclasses-avroschema allows code injection through generated Meta.schema_nameEPSS 0.4%CVE-2026-108385HIGHdataclasses-avroschema enum symbols can inject statements through generated member namesEPSS 0.4%CVE-2026-108382HIGHdataclasses-avroschema allows code injection through generated enum-symbol string literalsEPSS 0.4%