Arbitrary Code Execution in dataclasses-avroschema by Marcos Schroh

CVE-2026-108379

What is CVE-2026-108379?

The dataclasses-avroschema package from Marcos Schroh has a vulnerability that arises from improper handling of namespace values in generated types.confixed annotations. Specifically, the BaseGenerator.parse_fixed method fails to escape and validate fixed type namespace values, enabling a crafted quote to manipulate the namespace string. This can lead to arbitrary code execution during the evaluation of the generated Python code. A patch in version 0.70.6 addresses this issue by enforcing that namespace values must be a dot-separated list of valid Avro names.

References