{"id":"CVE-2026-108382","published":"2026-10-13T18:17:17.457","lastModified":"2026-10-16T16:00:33.533","description":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-vrq9-94ww-jv3c","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-vrq9-94ww-jv3c","tags":[]}],"exploitRefs":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-vrq9-94ww-jv3c","tags":[]},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-vrq9-94ww-jv3c","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers to inject arbitrary Python code into generated enum classes when using dataclasses-avroschema with schema-controlled enum symbols that contain quotes. This can lead to remote code execution during module import.","exploitability":"Exploitation requires a maliciously crafted schema with enum symbols containing quotes, and the attacker must be able to influence schema generation or deployment of generated code, which is moderately difficult but possible in environments where schemas are dynamically generated from untrusted input.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary Python code on systems that import the generated modules, potentially leading to full system compromise if the affected service runs with elevated privileges.","remediation":"Upgrade to version 0.70.6 or later to fix the enum symbol escaping vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","code-injection","python"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:50:49.536Z"}}