Threat Intelligence Database

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.

A code injection vulnerability (CWE-94) exists in dataclasses-avroschema versions 0.38.0 through 0.70.5. The vulnerability arises because enum field defaults are rendered as enum member references without proper validation, allowing injection of arbitrary code into generated Python modules. This can lead to namespace modification or prevent module loading. The issue is fixed in version 0.70.6 by validating enum defaults as valid names.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.

A code injection vulnerability exists in dataclasses-avroschema versions 0.44.0 through 0.70.5. The vulnerability arises because the Pydantic and AvroDantic model generators insert schema field annotations without safely restricting expressions, allowing arbitrary Python code execution when the generated module is imported. This issue is fixed in version 0.70.6 by restricting the annotation values to safe expressions.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.

CVE-2026-108378 is a code injection vulnerability in the dataclasses-avroschema Python library versions 0.40.0 through 0.70.5. The issue arises because the ClassRepresentation.render_docstring method copies schema record docstrings into generated Python class docstrings without properly escaping quotes or backslashes. This allows an attacker to inject Python code that executes during module import. The vulnerability is fixed in version 0.70.6 by escaping unsafe characters in docstrings.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.

A code injection vulnerability exists in dataclasses-avroschema versions 0.47.3 through 0.70.5. The issue arises because the software inserts a schema-controlled record name into a callable position in generated Python code without validating it properly. This allows a crafted record name to execute arbitrary Python expressions when the generated model instance consumes the field default. The vulnerability is fixed in version 0.70.6 by enforcing Avro name grammar validation on record names.