CVE-2026-108375: fallo de gravedad alta en marcosschroh dataclasses-avroschema
dataclasses-avroschema allows code injection through generated field-default literals
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.5%
probabilidad de explotación
0.5%top 60% de las CVE
explotación observada
noninguna fuente lo reporta
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
marcosschroh · dataclasses-avroschemaCVEs relacionadas — marcosschroh dataclasses-avroschema
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-108376HIGHdataclasses-avroschema allows code injection through record names in generated default factoriesEPSS 0.5%CVE-2026-108380HIGHdataclasses-avroschema field documentation allows code injection in generated Pydantic descriptionsEPSS 0.4%CVE-2026-108381HIGHdataclasses-avroschema pydantic-class metadata allows code injection in generated annotationsEPSS 0.4%CVE-2026-108377HIGHdataclasses-avroschema allows code injection through generated Meta.schema_nameEPSS 0.4%CVE-2026-108385HIGHdataclasses-avroschema enum symbols can inject statements through generated member namesEPSS 0.4%CVE-2026-108382HIGHdataclasses-avroschema allows code injection through generated enum-symbol string literalsEPSS 0.4%