CVE-2026-108385
Received Received - Intake

Enum Member Injection in dataclasses-avroschema

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-108385
EUVD
EUVD-2026-98982

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcosschroh dataclasses-avroschema >= 0.38.0, < 0.70.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in dataclasses-avroschema (versions 0.38.0 to 0.70.5) involves improper handling of enum symbol names during Avro schema generation. BaseGenerator.parse_enum and EnumRepresentation.render_symbols convert enum symbols to member names without validating them as valid identifiers. This allows malicious enum symbols containing newlines or punctuation to inject code into the generated enum class, potentially modifying namespaces or preventing module loading.

Detection Guidance

This vulnerability affects dataclasses-avroschema versions 0.38.0 through 0.70.5. To detect it, check the installed version of dataclasses-avroschema using pip show dataclasses-avroschema or pip list. If the version is within the vulnerable range, the system is potentially affected.

Impact Analysis

If you use affected versions of dataclasses-avroschema, an attacker could craft an Avro schema with specially named enum symbols to execute arbitrary code or disrupt application functionality when the schema is processed. This could lead to data breaches, service disruption, or unauthorized system access depending on the application context.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade dataclasses-avroschema to version 0.70.6 or later immediately. This version includes a fix that validates enum symbols as identifiers, preventing injection attacks. Use pip install --upgrade dataclasses-avroschema to apply the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart