Code Injection Risk in Dataclasses-Avroschema by Marcos Schroh

CVE-2026-108382

What is CVE-2026-108382?

The dataclasses-avroschema library, which converts Python dataclasses to Avro schemas, presents a vulnerability that allows for code injection when user-controlled enum symbols are improperly rendered. Specifically, versions 0.38.0 through 0.70.5 concatenate enum symbols within double quotes in enum assignments, leading to the potential execution of arbitrary Python code when the generated module is loaded. This issue is addressed in version 0.70.6, where enum symbol values are properly escaped to prevent exploitation. It's crucial for developers to update to the latest version to safeguard their applications.

References