dataclasses-avroschema CVE-2026-108375

Exploitation requires that the victim use the library's Avro-to-Python model generation feature (BaseGenerator/parse_fixed path) on an attacker-supplied schema containing a fixed type whose 'aliases' value is a bare string rather than a list, and then import the generated module - the arbitrary code executes at module import time. Limiting factors: the vulnerable direction is schema-to-code generation (not the more common dataclass-to-schema direction), the attacker must control the schema content, and a victim action (running the generator and importing/executing its output) is required, consistent with UI:R. Only versions 0.38.0 through 0.70.5 are affected; 0.70.6 rejects non-list aliases and is not exploitable.

This is a genuine high-priority code-execution flaw (CWE-94) rather than an inflated high-CVSS score, but its real-world risk is gated by a usage precondition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) correctly captures that no attacker privileges are needed and that impact is full compromise (C:H/I:H/A:H), while the UI:R flag accurately reflects that a victim must process an attacker-controlled schema. The AV:N is reasonable because Avro schemas are routinely pulled from remote sources (schema registries, Kafka topics, third-party repos), but exploitation is not fully remote-automatic: it depends on the victim actually invoking the ModelGenerator code-generation path and importing the generated module. No EPSS score, KEV entry, or published POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only exploitation enabler present is the fix commit diff, which discloses the vulnerable code path and could aid reverse-engineering of an exploit. Net assessment: a serious, low-complexity RCE for any workflow that generates Python from untrusted Avro schemas, but confined to that specific code-generation feature rather than the far more common schema-generation direction, which keeps aggregate exposure below what the 8.8 alone implies.

An attacker publishes or injects a crafted Avro schema in which a fixed type's 'aliases' field is a bare string (e.g. an arbitrary Python expression) instead of a list. When a developer or automated pipeline runs dataclasses-avroschema's model generator against that schema and imports the resulting module, the unquoted string is evaluated as Python, executing attacker code in the victim's process. No public exploit is identified in the provided data, though the fix commit publicly reveals the vulnerable parse_fixed path.