CVE-2026-108380

HIGH 8.8

dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.

CWE	CWE-94
Vendor	marcosschroh
Product	dataclasses-avroschema
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for marcosschroh dataclasses-avroschema

Be the first to know when new high vulnerabilities affecting marcosschroh dataclasses-avroschema are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

marcosschroh / dataclasses-avroschema

>= 0.65.9, < 0.70.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-g7p7-mgvm-jw7p github.com: https://github.com/marcosschroh/dataclasses-avroschema/pull/843 github.com: https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc github.com: https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6