CVE-2026-108375
Received Received - Intake

Code Injection in dataclasses-avroschema via Unescaped Defaults

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108375
EUVD
EUVD-2026-98901

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcosschroh dataclasses-avroschema >= 0.38.0, < 0.70.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in dataclasses-avroschema allows an attacker to inject malicious code into generated Python modules by exploiting improper escaping of field defaults in Avro schemas. Specifically, FieldRepresentation.get_field_default inserts unescaped string, UUID, bytes, or fixed field defaults into quoted literals in generated Python source code. A crafted default value can terminate the literal and inject executable statements that run when the module is imported.

Impact Analysis

This vulnerability can lead to arbitrary code execution when importing a module generated by affected versions of dataclasses-avroschema. Attackers could gain control over the system, steal sensitive data, or perform unauthorized actions. Users are impacted if they generate Python code from Avro schemas using versions 0.38.0 through 0.70.5.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update dataclasses-avroschema to version 0.70.6 or later to fix the vulnerability. Avoid using untrusted schema defaults in generated Python code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart