dataclasses-avroschema CVE-2026-108376

Exploitation requires that the target application uses dataclasses-avroschema's schema-to-Python model generator (the avro-to-code path) on an Avro schema whose enum field carries an attacker-controlled default value, AND that the generated Python module is subsequently imported or executed - the injected statements only run at import time. Applies to versions 0.38.0 through 0.70.5. Limiting factors: the victim must deliberately process an untrusted/attacker-supplied schema through codegen (this is the UI:R gate), so applications that only generate schemas FROM trusted local dataclasses, or that never import attacker-influenced generated code, are not exposed; additionally the payload is constrained because casefy.uppercase case-folds the enum default (injected letters are uppercased), which limits arbitrary payloads to namespace tampering and denial-of-load rather than unconstrained code of the attacker's choosing.

CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-reachable, low-complexity code-injection flaw (CWE-94) that requires user interaction. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so the exploitation status is 'no public exploit identified at time of analysis' - note, however, that the vendor fix commit (429f3d7) is public and precisely documents the sink, which materially lowers the bar for weaponization even though it is not itself an exploit. The most important nuance the raw CVSS score obscures is the UI:R requirement combined with the product's nature: this is a code-generation library, so exploitation is not drive-by - a victim must feed an attacker-controlled Avro schema through the schema-to-Python model generator and then import/load the resulting module. The description also constrains the primitive: because casefy.uppercase case-folds the enum default, injected letters are uppercased, so this is 'constrained statement injection' (namespace modification or a denial-of-load condition) rather than clean arbitrary code of the attacker's choosing - the C:H/I:H/A:H rating is defensible but the real-world impact ceiling is lower than an unconstrained RCE. Net: a genuine high-severity issue for the specific population that runs untrusted Avro schemas through codegen, but the UI:R gate and niche feature path make it a targeted-exposure risk rather than a mass-exploitation priority.

An attacker submits a malicious Avro schema (for example via an uploaded schema file, a schema registry entry, or an API that accepts schemas) to an application that uses dataclasses-avroschema's model generator to turn Avro schemas into Python code. The schema defines an enum field whose default value contains newlines, operators, or punctuation that survive casefy.uppercase and escape the intended enum-member reference, injecting statements into the generated module. When the victim imports or executes that generated module, the injected code runs, modifying the module namespace or preventing it from loading; no public POC was provided, though the fix commit documents the exact sink.