CVE-2026-108375: CWE-94: Improper Control of Generation of Code ('Code Injection') in marcosschroh dataclasses-avroschema

dataclasses-avroschema is a tool that generates Avro schemas from Python dataclasses and related models, and also generates Python code from Avro schemas. In versions 0.38.0 through 0.70.5, the method FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults directly into quoted literals in the generated Python source code without escaping. This improper control of code generation allows an attacker to craft a default value that terminates the string literal and injects arbitrary Python statements into the generated module. These injected statements execute upon module import, leading to code injection. Version 0.70.6 addresses this vulnerability by properly escaping schema values rendered into generated string literals.

Successful exploitation allows an attacker to execute arbitrary Python code in the context of the importing process. This can lead to full compromise of the application using dataclasses-avroschema, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 8.8 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade dataclasses-avroschema to version 0.70.6 or later, where the vulnerability is fixed by escaping schema values in generated string literals. No other mitigations are specified or recommended. Users should apply this official fix to prevent code injection via crafted schema defaults.