CVE-2026-108382: CWE-94: Improper Control of Generation of Code ('Code Injection') in marcosschroh dataclasses-avroschema

The dataclasses-avroschema library generates Python code from Avro schemas, including enum assignments. In versions 0.38.0 through 0.70.5, the EnumRepresentation.render_symbols method concatenates enum symbols directly into string literals without proper escaping. This allows an attacker to inject arbitrary Python code by including a quote character in an enum symbol, terminating the string literal and injecting code into the enum class body. The injected code executes upon import of the generated module. Version 0.70.6 addresses this vulnerability by escaping enum symbol values before rendering, preventing code injection.

Successful exploitation allows an attacker to execute arbitrary Python code in the context of the importing process, potentially leading to full system compromise, data theft, or disruption of service. The vulnerability has a high CVSS score of 8.8, indicating critical confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported.

Upgrade dataclasses-avroschema to version 0.70.6 or later, where the vulnerability is fixed by escaping enum symbol values before rendering. Users should avoid using vulnerable versions (>=0.38.0 <0.70.6) for code generation. No additional mitigations are specified by the vendor advisory.