dataclasses-avroschema CVE-2026-108378

Exploitation requires that the victim generate Python code from an attacker-influenced Avro schema using dataclasses-avroschema's model generator and then import the resulting module - the malicious payload lives specifically in a schema record's 'doc' value, which render_docstring (ClassRepresentation) copied into a triple-double-quoted class docstring without escaping quotes or backslashes in versions 0.40.0 through 0.70.5. The concrete trigger is a crafted triple-quote sequence (to close the docstring and inject class-body statements) and/or a trailing backslash (to escape the generated closing delimiter), with execution occurring at module import. Limiting factors: the attacker does not reach a live service directly (UI:R) - a human or pipeline must both run code generation on the untrusted schema and import the generated output, so environments that only generate models from trusted internal dataclasses/Pydantic models are not exposed; fixed in 0.70.6.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-injection flaw (CWE-94) whose only gating factor is user interaction (UI:R). That interaction is substantial and materially lowers real-world risk: exploitation requires a victim to feed an attacker-controlled Avro schema into dataclasses-avroschema's model generator AND then import the generated Python module - this is not a passive network service that an attacker can reach directly. No EPSS score, KEV listing, POC reference, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from the available signals. The vulnerability is confirmed and well-understood (vendor advisory GHSA-ff3j-hw44-6vx4 plus a fixing commit and release), and the described technique - closing a triple-quoted docstring with a crafted quote/backslash sequence to inject statements executed at import - is concrete and reliable once the schema reaches the generator. Net assessment: a genuine high-severity code-execution bug, but its practical priority is driven by whether an environment actually generates code from untrusted schemas; absent EPSS/KEV/POC evidence this reads as a real-but-conditional risk rather than confirmed widespread exploitation. Note the UI:R and the code-generation-plus-import prerequisite mean the raw 8.8 overstates risk for deployments that only generate schemas from trusted internal models.

An attacker supplies a malicious Avro schema whose record 'doc' field contains a crafted triple-quote-and-backslash sequence. A developer or automated pipeline runs dataclasses-avroschema's model generator on that schema (e.g. to scaffold Python models from a registry or submitted schema) and imports the generated module, at which point the injected statements execute and run arbitrary Python as the importing process. No public exploit code was identified in the provided data, but the advisory describes the injection mechanics precisely enough to reproduce.