CWE-94: Code Injection vulnerabilities

Adobe ColdFusion 2025 contains a critical code injection vulnerability (CVE-2026-106624) that allows an attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue results from improper control of code generation, enabling arbitrary code execution in the context of the current user. The vulnerability has a maximum CVSS score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability.

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-102870 is a high-severity code injection vulnerability in Microsoft .NET 10.0 installed on Linux, specifically affecting ASP.NET Core. It allows an unauthorized attacker to execute arbitrary code remotely due to improper control over code generation. Multiple versions of .NET 10.0 and related releases are affected, with official fixes available.

CVE-2026-96220 is a code injection vulnerability in Windows Assigned Access on Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges by improperly controlling code generation. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-85359 is a code injection vulnerability in Windows Performance Monitor on Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges by improperly controlling code generation. The vulnerability has a high severity score of 7.8 and affects multiple Windows 10 versions prior to specific fixed builds. Microsoft has issued official fixes for all affected versions.

CVE-2026-83759 is a code injection vulnerability in the Windows Encrypting File System (EFS) component of Microsoft Windows 10 Version 1607 and later builds. This flaw allows an authorized attacker to execute arbitrary code remotely over a network. The vulnerability affects multiple Windows 10 build ranges prior to specific fixed versions. A high-severity CVSS 3.1 score of 8.8 reflects the critical impact on confidentiality, integrity, and availability. Official patches have been released by Microsoft to address this issue.

CVE-2026-102863 is a code injection vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to elevate privileges over a network. The flaw involves improper control of code generation, classified under CWE-94. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. A high-severity issue with a CVSS score of 8.8, it has been officially fixed in version 16.0.20326.20190.

CVE-2026-103572 is a high-severity code injection vulnerability in Microsoft Visual Studio 2022 version 17.14, specifically affecting Visual Studio Tools for Applications and SQL Server Management Studio. It allows an unauthorized attacker to execute code remotely over a network. The flaw is due to improper control of code generation. Official fixes have been released in versions 17.14.42 and 18.10.4.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.

A code injection vulnerability exists in dataclasses-avroschema versions 0.38.0 through 0.70.5. The vulnerability arises because the BaseGenerator.parse_fixed method interpolates a fixed type's aliases value directly into generated Python code without proper sanitization. If the aliases value is a bare string, it is emitted as an unquoted Python expression and evaluated when the generated module is imported, enabling arbitrary code execution. This issue is fixed in version 0.70.6 by rejecting aliases values that are not lists.

A code injection vulnerability exists in dataclasses-avroschema versions 0.38.0 through 0.70.5. The issue arises from improper validation of enum field defaults during schema generation, allowing injection of malicious code via crafted enum defaults. This can lead to namespace modification or failure to load the generated module. Version 0.70.6 addresses this by validating enum defaults as valid identifiers.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.

A code injection vulnerability (CWE-94) exists in dataclasses-avroschema versions 0.44.0 through 0.70.5. The vulnerability arises because the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value into generated Python code annotations without proper restriction, allowing arbitrary Python code execution when the generated module is imported. This issue is fixed in version 0.70.6 by restricting the inserted value to a bare name or a call to a bare name with literal arguments.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.

A code injection vulnerability exists in dataclasses-avroschema versions 0.38.0 through 0.70.5. The issue arises from improper handling of the fixed type's namespace value in generated Python code, allowing an attacker to inject arbitrary code. This is fixed in version 0.70.6 by enforcing namespace validation.

dataclasses-avroschema versions 0.40.0 through 0.70.5 contain a code injection vulnerability in the ClassRepresentation.render_docstring function. This function copies schema record doc values into generated Python class docstrings without escaping quotes or backslashes, allowing crafted input to inject and execute arbitrary Python code during module import. Version 0.70.6 addresses this issue by properly escaping unsafe characters in docstrings.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.

A code injection vulnerability exists in dataclasses-avroschema versions 0.47.3 through 0.70.5. The issue arises because the FieldRepresentation.get_field_default method inserts a schema-controlled record name into a generated default_factory lambda without validating it as a proper Avro name. This allows a crafted record name to be interpreted as arbitrary Python code, which executes when an instance of the generated model uses the field default. The vulnerability is fixed in version 0.70.6 by enforcing Avro name grammar validation on record names.

A code injection vulnerability (CWE-94) exists in dataclasses-avroschema versions 0.38.0 through 0.70.5. The vulnerability arises because FieldRepresentation.get_field_default inserts certain schema-controlled default values into generated Python source code without proper escaping. This allows crafted defaults to break out of string literals and inject arbitrary code that executes when the generated module is imported. The issue is fixed in version 0.70.6 by escaping schema values in generated string literals.