CVE-2026-108378
Received Received - Intake

Code Injection in dataclasses-avroschema via Docstring

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108378
EUVD
EUVD-2026-98964

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcosschroh dataclasses-avroschema >= 0.40.0, < 0.70.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in dataclasses-avroschema versions 0.40.0 through 0.70.5. It allows an attacker to inject malicious Python code into generated classes by exploiting improper escaping of quotes and backslashes in docstrings. The ClassRepresentation.render_docstring function copies a record's doc value into a class docstring without escaping special characters, enabling code execution during module import.

Detection Guidance

Check if your system uses dataclasses-avroschema versions between 0.40.0 and 0.70.5. Run: pip show dataclasses-avroschema. If installed, verify version with pip list | grep dataclasses-avroschema.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code on your system when you import a module generated by dataclasses-avroschema. It may lead to data breaches, system compromise, or unauthorized access depending on the context in which the library is used.

Mitigation Strategies

Upgrade dataclasses-avroschema to version 0.70.6 or later. Run: pip install --upgrade dataclasses-avroschema. Review generated code for suspicious docstrings or imports.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart