{"id":"CVE-2026-108378","published":"2026-10-13T18:17:16.857","lastModified":"2026-10-16T16:00:33.533","description":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-ff3j-hw44-6vx4","tags":[]}],"exploitRefs":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-ff3j-hw44-6vx4","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers to inject arbitrary Python code into generated classes during module import by exploiting unsafe docstring rendering in dataclasses-avroschema. This can lead to remote code execution when the vulnerable module is loaded.","exploitability":"Exploitation requires a malicious schema with crafted triple-quote sequences and trailing backslashes, but is relatively straightforward once an attacker can influence schema generation or deployment.","blast_radius":"The vulnerability affects any application using dataclasses-avroschema to generate Python code from Avro schemas, potentially impacting many backend services and microservices that rely on schema generation.","remediation":"Upgrade to version 0.70.6 or later to fix the unsafe docstring rendering issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","code-injection","python","schema"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:50:26.334Z"}}