CVE-2026-108380highCWE-94

CVE-2026-108380: fallo de gravedad alta en marcosschroh dataclasses-avroschema

dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions

Publicada el

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.4%
probabilidad de explotación
0.4%top 61% de las CVE
explotación observada
noninguna fuente lo reporta
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
marcosschroh · dataclasses-avroschema
CVEs relacionadas — marcosschroh dataclasses-avroschema

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-108376HIGHdataclasses-avroschema allows code injection through record names in generated default factoriesEPSS 0.5%CVE-2026-108375HIGHdataclasses-avroschema allows code injection through generated field-default literalsEPSS 0.5%CVE-2026-108381HIGHdataclasses-avroschema pydantic-class metadata allows code injection in generated annotationsEPSS 0.4%CVE-2026-108377HIGHdataclasses-avroschema allows code injection through generated Meta.schema_nameEPSS 0.4%CVE-2026-108385HIGHdataclasses-avroschema enum symbols can inject statements through generated member namesEPSS 0.4%CVE-2026-108382HIGHdataclasses-avroschema allows code injection through generated enum-symbol string literalsEPSS 0.4%
Referencias
https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fchttps://github.com/marcosschroh/dataclasses-avroschema/pull/843https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-g7p7-mgvm-jw7p