CVE-2026-108379
Received Received - Intake

Arbitrary Code Execution in dataclasses-avroschema

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108379
EUVD
EUVD-2026-98975

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcosschroh dataclasses-avroschema >= 0.38.0, < 0.70.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in dataclasses-avroschema versions 0.38.0 through 0.70.5. It involves the BaseGenerator.parse_fixed function inserting a fixed type's namespace value into a generated types.confixed annotation without proper escaping or validation. This allows a crafted quote to break out of the namespace string and modify the surrounding annotation expression, which Python evaluates during class definition, enabling arbitrary code execution.

Detection Guidance

This vulnerability can be detected by checking the version of dataclasses-avroschema installed in your environment. Run: pip show dataclasses-avroschema. If the version is between 0.38.0 and 0.70.5, the system is vulnerable.

Impact Analysis

If you use a vulnerable version of dataclasses-avroschema, an attacker could exploit this flaw to execute arbitrary code on your system. This could lead to data breaches, unauthorized access, or system compromise, depending on the context in which the library is used.

Mitigation Strategies

Immediately upgrade dataclasses-avroschema to version 0.70.6 or later. Run: pip install --upgrade dataclasses-avroschema. Review any generated Avro schemas for suspicious annotations that may indicate exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart