CVE-2026-108382
Received Received - Intake

Enum Code Injection in dataclasses-avroschema

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108382
EUVD
EUVD-2026-98978

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcosschroh dataclasses-avroschema >= 0.38.0, < 0.70.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in dataclasses-avroschema (versions 0.38.0 to 0.70.5) involves improper handling of enum symbols in generated Avro schemas. When creating Python code from these schemas, the EnumRepresentation.render_symbols function concatenates enum symbols between double quotes without proper escaping. This allows a quote in an enum symbol to terminate the string literal and inject arbitrary Python code into the enum class body. The injected code executes when the generated module is imported.

Detection Guidance

To detect this vulnerability, inspect Python modules generated by dataclasses-avroschema versions 0.38.0 through 0.70.5 for enum assignments containing unescaped quotes in enum symbols. Check for arbitrary code execution during module import by reviewing generated enum class bodies for injected Python code.

Impact Analysis

This vulnerability can lead to arbitrary code execution when importing a generated module. Attackers could craft malicious enum symbols to execute code with the privileges of the importing process. This could result in data breaches, system compromise, or further lateral movement within a network if the importing application has elevated permissions.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized code execution, potentially leading to data exfiltration or system manipulation. GDPR requires protecting personal data integrity and confidentiality, while HIPAA mandates safeguarding protected health information. Exploitation could result in unauthorized access to regulated data, triggering breach notification requirements and potential fines.

Mitigation Strategies

Upgrade dataclasses-avroschema to version 0.70.6 or later to patch the vulnerability. If immediate upgrade is not possible, avoid using generator classes directly or review all generated enum classes for suspicious symbols before importing modules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart