CVE-2026-108378: CWE-94: Improper Control of Generation of Code ('Code Injection') in marcosschroh dataclasses-avroschema

The dataclasses-avroschema library generates Python code from Avro schemas. Between versions 0.40.0 and 0.70.5, the ClassRepresentation.render_docstring method directly inserts schema record docstrings into generated class docstrings without escaping triple quotes or backslashes. An attacker can craft a triple-quote sequence to prematurely close the docstring and inject arbitrary Python statements into the class body. Additionally, a trailing backslash can escape the closing delimiter, enabling code execution during module import. Version 0.70.6 addresses this by escaping quotes, backslashes, and unsafe control characters before rendering docstrings, mitigating the injection risk.

Successful exploitation allows an attacker to execute arbitrary Python code during module import, leading to full confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade dataclasses-avroschema to version 0.70.6 or later, where the vulnerability is fixed by proper escaping of quotes, backslashes, and unsafe control characters in generated docstrings. No other mitigation is indicated or required.