CVE-2026-108381

HIGH 8.8

dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.

CWE	CWE-94
Vendor	marcosschroh
Product	dataclasses-avroschema
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for marcosschroh dataclasses-avroschema

Be the first to know when new high vulnerabilities affecting marcosschroh dataclasses-avroschema are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

marcosschroh / dataclasses-avroschema

>= 0.44.0, < 0.70.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-4jmx-9m83-vxx8 github.com: https://github.com/marcosschroh/dataclasses-avroschema/pull/358 github.com: https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc github.com: https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6