{"id":"CVE-2026-108380","published":"2026-10-13T18:17:17.157","lastModified":"2026-10-16T20:04:29.760","description":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/pull/843","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-g7p7-mgvm-jw7p","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-g7p7-mgvm-jw7p","tags":[]}],"exploitRefs":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/pull/843","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-g7p7-mgvm-jw7p","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-g7p7-mgvm-jw7p","tags":[]}],"hasPoc":true,"ai":{"summary":"A Python library vulnerability allows arbitrary code execution during schema generation when user-provided documentation contains unescaped quotes. This enables attackers to inject malicious expressions into generated Pydantic models.","exploitability":"Moderately difficult to exploit as it requires crafting malicious documentation with quotes that terminate string literals, but can be achieved through controlled input in schema definitions.","blast_radius":"High impact across applications using dataclasses-avroschema for generating Pydantic models, especially those accepting user input in schema documentation fields.","remediation":"Upgrade to version 0.70.6 or later to fix the quote escaping vulnerability in PydanticFieldRepresentation.add_field_properties.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","python","schema"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:50:37.328Z"}}