CVE-2026-108377: fallo de gravedad alta en marcosschroh dataclasses-avroschema
dataclasses-avroschema allows code injection through generated Meta.schema_name
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.4%
probabilidad de explotación
0.4%top 69% de las CVE
explotación observada
noninguna fuente lo reporta
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
marcosschroh · dataclasses-avroschemaCVEs relacionadas — marcosschroh dataclasses-avroschema
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-108376HIGHdataclasses-avroschema allows code injection through record names in generated default factoriesEPSS 0.5%CVE-2026-108375HIGHdataclasses-avroschema allows code injection through generated field-default literalsEPSS 0.5%CVE-2026-108380HIGHdataclasses-avroschema field documentation allows code injection in generated Pydantic descriptionsEPSS 0.4%CVE-2026-108381HIGHdataclasses-avroschema pydantic-class metadata allows code injection in generated annotationsEPSS 0.4%CVE-2026-108385HIGHdataclasses-avroschema enum symbols can inject statements through generated member namesEPSS 0.4%CVE-2026-108382HIGHdataclasses-avroschema allows code injection through generated enum-symbol string literalsEPSS 0.4%
Referencias
https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fchttps://github.com/marcosschroh/dataclasses-avroschema/commit/919d3e07c8938369cfc2c0569007ba373247e74ahttps://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-57hr-pcm8-p9j9