dataclasses-avroschema CVE-2026-108379

Exploitation requires that the victim use dataclasses-avroschema's model-generation feature (BaseGenerator.parse_fixed path) to generate Python code from an Avro schema whose contents an attacker can influence, specifically a 'fixed' type carrying a crafted namespace value containing a quote character; the resulting code must then be defined/imported for the injected expression to execute. Affected versions are 0.38.0 through 0.70.5. The practical limiter is that this is not a flaw in merely using the library at runtime - the target must feed untrusted schemas through the code generator (UI:R), so deployments that only generate code from trusted, internal schemas are not realistically exploitable; upgrading to 0.70.6 removes the vector by validating the namespace.

This is a legitimately high-impact code-injection flaw (CWE-94) with a confirmed GitHub Security Advisory (GHSA-h9q3-f96w-f88j), a vendor fix commit, and a tagged release (0.70.6), so the technical facts are well-corroborated. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated issue that nonetheless requires user interaction - the UI:R is important: exploitation is not automatic but depends on a victim running the code generator over an attacker-influenced Avro schema and then defining the generated class. No CISA KEV listing and no EPSS score were supplied in the input, and no public exploit is referenced, so there is no evidence of active or widespread exploitation; this reads as a credible-but-not-yet-exploited supply-chain/codegen risk rather than an in-the-wild emergency. The gap between a high CVSS (8.8) and the absence of KEV/EPSS/POC signals suggests priority should be driven by whether an organization actually consumes untrusted Avro schemas through this library's code generator, not by the raw score alone. No key signals conflict with each other, but EPSS and exploitation-status data are simply missing and should be checked before final triage.

An attacker supplies a malicious Avro schema (for example, one fetched from a registry, uploaded by a user, or pulled from an untrusted repository) containing a 'fixed' type whose namespace embeds a crafted quote character. When a developer or automated pipeline runs dataclasses-avroschema's model generator to turn that schema into Python code, the namespace breaks out of the types.confixed string literal and injects an arbitrary expression. The injected expression executes the moment the generated class is defined/imported, yielding arbitrary code execution; no public exploit code was referenced in the provided data.