CVE-2026-108380: CWE-94: Improper Control of Generation of Code ('Code Injection') in marcosschroh dataclasses-avroschema

dataclasses-avroschema generates Avro schemas and Python code from Python dataclasses, Pydantic models, and Faust Records. In versions 0.65.9 through 0.70.5, the add_field_properties method in PydanticFieldRepresentation inserts the doc string of a schema field directly into a pydantic.Field description argument without escaping quotes. An attacker can craft a doc string containing quotes to terminate the string and inject Python expressions that are evaluated during the generated class definition. This leads to arbitrary code execution during Pydantic and AvroDantic model generation. The vulnerability is resolved in version 0.70.6 by escaping the doc string before rendering.

Successful exploitation allows an unauthenticated attacker to execute arbitrary Python code during the generation of Pydantic and AvroDantic models. This can lead to full system compromise, data loss, or denial of service. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade dataclasses-avroschema to version 0.70.6 or later, where the vulnerability is fixed by escaping the documentation value before rendering. No other mitigation is required as the fix addresses the root cause.