CVE-2026-108375 in dataclasses-avroschema
Summary
by MITRE • 10/13/2026
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The dataclasses-avroschema library serves as a critical utility for Python developers working with Apache Avro serialization formats, enabling the automatic generation of Avro schemas from Python data structures and vice versa. A significant security flaw was identified in versions ranging from 0.38.0 through 0.70.5 within the FieldRepresentation.get_field_default method. This function is responsible for determining default values for fields during code generation. The vulnerability stems from an improper handling of string literals when rendering schema-defined defaults for specific data types, including strings, UUIDs, bytes, and fixed-length byte arrays. When these default values are embedded into the generated Python source code as quoted literal strings, the library fails to escape special characters that have syntactic significance in Python, such as single quotes or double quotes depending on the surrounding context of the string delimiter.
This lack of input sanitization creates a classic Code Injection vulnerability, specifically categorized under CWE-94 Improper Control of Generation of Code (Code Injection). An attacker who controls the schema definition can craft a malicious default value containing unescaped quote characters and arbitrary Python statements. For instance, if the generated code uses single quotes to wrap the string literal, an input like 'test'; import os; print('pwned' would break out of the string context and inject executable commands into the module body. Because this injection occurs at the point where the default value is written to the source file, it does not require runtime execution of malicious code within a running process but rather relies on the static analysis or compilation phase triggered by importing the generated module.
The operational impact of this vulnerability is severe due to its Remote Code Execution potential under specific development workflows. If an application imports a Python module that was automatically generated from a compromised Avro schema, the injected payload executes immediately upon importation. This mechanism allows for arbitrary code execution on the host system where the generation and subsequent import take place. In environments where schemas are fetched from external or untrusted sources before being processed into Python modules, this vulnerability can be exploited to compromise the integrity of the development environment or production servers if such generated files are deployed without review. The attack vector is effectively a supply chain compromise via schema manipulation, leveraging the trust placed in auto-generated code artifacts.
Mitigation strategies primarily involve upgrading to version 0.70.6 or later, where the vulnerability has been patched by implementing proper escaping of schema values before they are rendered into generated string literals. This ensures that special characters within default values are safely encoded and do not interfere with Python syntax. For organizations unable to upgrade immediately, manual review of all auto-generated code is recommended to detect any injected payloads. Additionally, developers should avoid importing dynamically generated modules from untrusted sources without rigorous static analysis or sandboxing. Adhering to the principle of least privilege during development can also limit the blast radius if such an injection were to occur in a less controlled environment. This incident highlights the importance of treating auto-generated code with the same security scrutiny as hand-written source, particularly when inputs originate from external schema definitions.