dataclasses-avroschema CVE-2026-108383

Exploitation requires that the victim run dataclasses-avroschema's Avro-schema-to-Python code generator (model_generator) on an attacker-controlled Avro schema, specifically one containing an enum field whose default value includes newlines, operators, or punctuation; because casefy.uppercase only case-folds, these characters survive into the rendered enum member reference and escape it as injected code. The injected statements execute when the generated module is imported/loaded, enabling namespace modification or a denial of module loading. Affected versions are 0.38.0 through 0.70.5. Limiting factors: the attacker cannot trigger this via normal runtime schema generation - it requires the code-generation path plus subsequent import of the generated module, so deployments that only generate schemas from their own trusted models, or never import attacker-influenced generated code, are not exposed.

This is a genuine code-injection flaw (CWE-94) in dataclasses-avroschema's Avro-to-Python code generator, confirmed and patched by the maintainer in 0.70.6. The input CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects that an attacker who controls an Avro schema can inject statements into the generated module. However, the network vector is contingent: exploitation is only 'remote' in the sense that a malicious schema can arrive over the network - the actual trigger requires a victim to run the code-generation path on that schema and then import/load the resulting module (hence UI:R). No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a high-CVSS issue whose real-world risk is gated by a fairly specific usage pattern (generating Python code from untrusted Avro schemas) rather than a broadly automatable remote RCE. Priority is moderate-to-high for the subset of deployments that generate code from externally sourced schemas, and low for the many users who only use the library to produce schemas from their own trusted models.

An application uses dataclasses-avroschema's model generator to convert an externally supplied Avro schema into Python source. An attacker submits a schema containing an enum field whose default value embeds newlines and punctuation; after case conversion this 'default' is rendered unvalidated as an enum member reference, letting the attacker inject arbitrary statements that execute when the generated module is imported. No public exploit code was identified in the provided data.