Code Injection Vulnerability in dataclasses-avroschema by Marcos Schroh

CVE-2026-108376

What is CVE-2026-108376?

The dataclasses-avroschema library, used for generating Avro schemas from Python data classes and Pydantic models, contains a vulnerability in versions 0.47.3 to 0.70.5. The issue arises from the FieldRepresentation.get_field_default method, which improperly inserts a schema-controlled reference into a generated default factory lambda without validating whether it is a proper Avro name. This vulnerability permits an attacker to execute arbitrary Python expressions by crafting a malicious record name, resulting in potential exploitation when instances of the affected models consume the field default. To mitigate this vulnerability, users should update to version 0.70.6, where validations for record names against Avro name grammar have been implemented.

References