{"id":"CVE-2026-108376","published":"2026-10-13T18:17:16.550","lastModified":"2026-10-16T23:16:58.403","description":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-jcjg-gjg5-xp7v","tags":[]},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110113-publiccms-trade-address-save-cross-user-overwrite","tags":[]}],"exploitRefs":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-jcjg-gjg5-xp7v","tags":[]}],"hasPoc":true,"ai":{"summary":"A Python library vulnerability allows attackers to inject arbitrary Python code through crafted Avro record names in default factory lambdas, leading to remote code execution when models are instantiated.","exploitability":"Exploitation requires a maliciously crafted Avro schema with a record name that becomes executable Python code in a lambda expression, but is relatively straightforward when applications use this library to process untrusted Avro data.","blast_radius":"The vulnerability could affect any application using dataclasses-avroschema to process untrusted Avro schemas, potentially leading to widespread remote code execution across services that consume such data.","remediation":"Upgrade to version 0.70.6 or later to fix the Avro name validation issue in FieldRepresentation.get_field_default.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","python","avro"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:50:14.867Z"}}