CVE-2026-108383: fallo de gravedad alta en marcosschroh dataclasses-avroschema
dataclasses-avroschema enum field defaults can inject statements into generated modules
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.3%
probabilidad de explotación
0.3%top 79% de las CVE
explotación observada
noninguna fuente lo reporta
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
marcosschroh · dataclasses-avroschemaCVEs relacionadas — marcosschroh dataclasses-avroschema
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-108376HIGHdataclasses-avroschema allows code injection through record names in generated default factoriesEPSS 0.5%CVE-2026-108375HIGHdataclasses-avroschema allows code injection through generated field-default literalsEPSS 0.5%CVE-2026-108380HIGHdataclasses-avroschema field documentation allows code injection in generated Pydantic descriptionsEPSS 0.4%CVE-2026-108381HIGHdataclasses-avroschema pydantic-class metadata allows code injection in generated annotationsEPSS 0.4%CVE-2026-108377HIGHdataclasses-avroschema allows code injection through generated Meta.schema_nameEPSS 0.4%CVE-2026-108385HIGHdataclasses-avroschema enum symbols can inject statements through generated member namesEPSS 0.4%