CVE-2026-108379: CWE-94: Improper Control of Generation of Code ('Code Injection') in marcosschroh dataclasses-avroschema

The dataclasses-avroschema library generates Python code from Avro schemas. In versions 0.38.0 through 0.70.5, the BaseGenerator.parse_fixed method inserts the fixed type's namespace value into a types.confixed annotation without escaping or validating it. If an attacker supplies a namespace containing crafted quotes, they can terminate the string early and inject arbitrary Python code into the generated class definition. This leads to arbitrary code execution when the class is defined. Version 0.70.6 mitigates this by requiring namespaces to be valid Avro names separated by dots, preventing injection.

Successful exploitation allows an attacker to execute arbitrary Python code in the context where the generated class is defined. This can lead to full compromise of the application or environment running the vulnerable dataclasses-avroschema code. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade to dataclasses-avroschema version 0.70.6 or later, which enforces validation of the namespace to prevent code injection. No other mitigations are indicated or required once the upgrade is applied.