Arbitrary Code Execution in dataclasses-avroschema from Marcos Schroh

CVE-2026-108380

What is CVE-2026-108380?

The dataclasses-avroschema library, used for generating Avro schemas from Python dataclasses and models, contains a critical issue in versions 0.65.9 to 0.70.5. Specifically, PydanticFieldRepresentation.add_field_properties improperly handles schema field's documentation strings. If a crafted quote is inserted, it can terminate the string, enabling attackers to inject arbitrary Python code during the model generation process. Version 0.70.6 rectifies this by escaping documentation values before rendering.

References