dataclasses-avroschema CVE-2026-108380

Exploitation requires that the victim invoke dataclasses-avroschema's Pydantic or AvroDantic model-generation path on an Avro schema the attacker controls, where the schema includes a 'doc' attribute on a field; the doc value is inserted unescaped between the quotes of a generated pydantic.Field(description="...") argument, so a crafted quote closes the string and injects a Python expression evaluated when the generated class is defined. Limiting factors: only versions 0.65.9 through 0.70.5 are affected (fixed in 0.70.6); only the Pydantic and AvroDantic generators are vulnerable (plain dataclass and Faust generation do not render the doc as a Field description); and exploitation depends on the user actively running code generation over an untrusted or externally-sourced schema rather than any always-on network service.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a genuine arbitrary-code-execution flaw (CWE-94), but real-world urgency is tempered by the exploitation model: this is a developer/build-time code-generation library, and the malicious input is an Avro schema whose 'doc' field breaks out of a generated pydantic.Field description string. The AV:N rating is defensible because Avro schemas are frequently pulled from shared schema registries or other systems, yet the practical trigger is a victim choosing to run Pydantic/AvroDantic model generation over an attacker-controlled schema (hence UI:R), so this is not a remotely-sprayable server exploit. No EPSS score, KEV listing, SSVC decision, or public POC is present in the provided intelligence - the only exploit-relevant artifacts are the fix PR, fix commit, and 0.70.6 release. Exploitation status: no public exploit identified at time of analysis. Net: a real code-injection bug worth patching promptly in any pipeline that generates code from untrusted or externally-sourced Avro schemas, but closer to a supply-chain/build-tooling risk than a mass-exploited internet-facing CVE, and the headline 8.8 overstates the likelihood of opportunistic widespread exploitation.

An attacker publishes or submits an Avro schema whose field 'doc' value contains a crafted double-quote followed by a Python expression that closes the description string and appends an evaluated call. When a developer or automated pipeline runs dataclasses-avroschema's Pydantic or AvroDantic model generation on that schema, the injected expression is evaluated during generated class definition, executing arbitrary Python in the generating process. No public POC is referenced in the provided data, but the mechanism is fully confirmed by the fix diff.