CVE-2026-108381

Awaiting Analysis Awaiting Analysis - Queue

Code Injection in dataclasses-avroschema Pydantic Models

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108381

EUVD

EUVD-2026-98977

Affected Vendors & Products

Vendor	Product	Version / Range
marcosschroh	dataclasses-avroschema	>= 0.44.0, < 0.70.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

The vulnerability in dataclasses-avroschema (versions 0.44.0 to 0.70.5) involves unsafe insertion of a schema field's pydantic-class value into generated field annotations. This allows crafted values to execute arbitrary Python code when the generated module is imported, as annotations are evaluated at import time.

Detection Guidance

Check installed versions of dataclasses-avroschema with pip show dataclasses-avroschema. If version is <=0.70.5, the system is vulnerable. Search codebases for generated Avro schemas using pydantic-class attributes.

Impact Analysis

An attacker could exploit this to run malicious code on systems using affected versions of dataclasses-avroschema. This could lead to unauthorized data access, system compromise, or further attacks within the environment where the generated code is used.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA by enabling access to or manipulation of sensitive data. Compliance may be compromised if systems are not patched.

Mitigation Strategies

Update dataclasses-avroschema to version 0.70.6 or later to fix the vulnerability. Review any generated code for suspicious annotations and remove untrusted pydantic-class values.

Hi! I’m here to help you understand CVE-2026-108381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70