Enum Field Default Vulnerability in dataclasses-avroschema by Marcos Schroh

CVE-2026-108383

What is CVE-2026-108383?

The dataclasses-avroschema library has a flaw where FieldRepresentation.get_field_default permits schema-controlled enum field defaults to be rendered without proper validation. This vulnerability enables the injection of newlines, operators, and punctuation, allowing attackers to manipulate namespaces or even obstruct the module from loading. The issue has been addressed in version 0.70.6, which incorporates validation for enum defaults, making them recognized strictly as valid names.

References