Code Injection Vulnerability in dataclasses-avroschema by Marcos Schroh

CVE-2026-108378

What is CVE-2026-108378?

The dataclasses-avroschema tool processes Python dataclasses and converts them into Avro schemas, as well as generating corresponding Python code. A vulnerability exists in versions 0.40.0 through 0.70.5, where the ClassRepresentation.render_docstring method improperly handles schema record documentation values. It fails to escape quotation marks and backslashes, leading to the potential for crafted input to manipulate the closing of the docstring. This misconfiguration may allow for code injection during module imports, posing a significant security risk for applications relying on this library. The issue has been addressed in version 0.70.6, where the library now correctly escapes unsafe characters before docstring rendering.

References