{"id":"CVE-2026-108377","published":"2026-10-13T18:17:16.697","lastModified":"2026-10-16T16:00:33.533","description":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/919d3e07c8938369cfc2c0569007ba373247e74a","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-57hr-pcm8-p9j9","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-57hr-pcm8-p9j9","tags":[]}],"exploitRefs":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/919d3e07c8938369cfc2c0569007ba373247e74a","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-57hr-pcm8-p9j9","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-57hr-pcm8-p9j9","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers to inject arbitrary Python code into generated classes by manipulating schema names, leading to remote code execution when the generated modules are imported. This affects applications using dataclasses-avroschema to generate Python code from Avro schemas.","exploitability":"Exploitation requires a malicious schema name that can terminate string literals and inject code, with no additional preconditions needed beyond having the vulnerable library version installed.","blast_radius":"The vulnerability could impact any application that generates Python classes from Avro schemas using the affected library version, potentially allowing attackers to execute arbitrary code on systems where generated modules are imported.","remediation":"Upgrade to version 0.70.6 or later to fix the string escaping vulnerability in ClassRepresentation.render_metaclass.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","code-injection","python","data-processing"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:50:20.795Z"}}