Injection Flaw in dataclasses-avroschema Affects Python Code Generation

CVE-2026-108375

What is CVE-2026-108375?

The dataclasses-avroschema library, which generates Avro schemas and corresponding Python code from Python dataclasses, Pydantic models, and Faust Records, contains an injection flaw. Versions 0.38.0 through 0.70.5 improperly handle schema-controlled defaults, allowing crafted input to terminate string literals, potentially leading to the execution of arbitrary code upon import of the generated modules. This issue was resolved in version 0.70.6 by implementing proper escaping mechanisms for string literals derived from schema values.

References