CVE-2026-108376
Received Received - Intake

Arbitrary Code Execution in dataclasses-avroschema

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108376
EUVD
EUVD-2026-98906

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcosschroh dataclasses-avroschema >= 0.47.3, < 0.70.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in dataclasses-avroschema versions 0.47.3 through 0.70.5. It involves a flaw in FieldRepresentation.get_field_default where a schema-controlled record name is inserted into a lambda function's callable position without validation. This allows a crafted record name to become an arbitrary Python expression that executes when a model instance uses the field default.

Detection Guidance

Detecting this vulnerability requires checking the version of dataclasses-avroschema in use. Run: pip show dataclasses-avroschema. If the version is between 0.47.3 and 0.70.5, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute arbitrary code when a vulnerable application processes Avro schemas. This could lead to data breaches, system compromise, or unauthorized actions depending on the application's context and permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade dataclasses-avroschema to version 0.70.6 or later immediately. Use: pip install --upgrade dataclasses-avroschema==0.70.6.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart