CVE-2026-108377
Received Received - Intake

ClassRepresentation.render_metaclass Code Injection in dataclasses-avroschema

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108377
EUVD
EUVD-2026-98962

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcosschroh dataclasses-avroschema >= 0.62.3, < 0.70.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in dataclasses-avroschema (versions 0.62.3 to 0.70.5) allows an attacker to inject malicious code into generated Python source files. This happens because the ClassRepresentation.render_metaclass function inserts an unescaped Avro record name into a quoted Meta.schema_name field. A specially crafted name can break out of the string literal and inject executable statements into the generated class body.

Impact Analysis

If you use affected versions of dataclasses-avroschema, an attacker could craft a malicious Avro schema that generates Python code executing arbitrary commands when the generated module is imported. This could lead to code execution, data theft, or system compromise depending on the attacker's goals.

Mitigation Strategies

Upgrade dataclasses-avroschema to version 0.70.6 or later to fix the vulnerability by escaping schema values in generated string literals.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108377. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart