dataclasses-avroschema CVE-2026-108384

Exploitation requires that the victim use the library's Avro-schema-to-Python model generation (ModelGenerator/BaseGenerator.parse_fixed) - not merely the schema-generation direction - on an attacker-influenced schema, and then import the generated module. The specific trigger is a fixed-type definition whose 'aliases' field is supplied as a bare string containing a Python expression instead of a JSON list; only then is the value emitted unquoted into the types.confixed annotation and evaluated at import time. Limiting factors: affects only versions 0.38.0 through 0.70.5; requires active developer interaction (running codegen plus importing the output, hence UI:R); and requires the schema source to be untrusted/attacker-controlled. Environments that only generate schemas from trusted local dataclasses/Pydantic models, or that never run the code-generation path, are not exposed.

This is a genuine high-severity code-execution flaw (CWE-94) rather than an inflated-CVSS paper risk, but its real-world exploitability is narrower than the 8.8 AV:N score alone suggests. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R) correctly captures the two decisive facts: no authentication is needed and the attacker only supplies a crafted Avro schema, but the UI:R flag is doing heavy lifting - a developer must actively run the schema-to-Python code-generation feature on the attacker's schema AND import the resulting module for code to execute. No EPSS score, KEV listing, or POC is present in the supplied data; exploitation status is therefore 'no public exploit identified at time of analysis.' The AV:N rating is defensible but borderline - exploitation hinges on untrusted schema content reaching a build/codegen step rather than on a listening network service, so treat AV:N as 'attacker-controlled schema delivered to victim' rather than a directly reachable remote endpoint. Priority should be driven by whether an organization actually uses this library's code-generation path on externally sourced schemas; where that pipeline exists the impact is full RCE and patching to 0.70.6 is urgent, but blanket-critical treatment is not warranted given the required developer interaction and the absence of any active-exploitation or exploit-availability signal.

An attacker publishes or submits a malicious Avro schema containing a fixed-type whose 'aliases' value is a bare string (e.g. embedding a Python expression) instead of a list. A developer feeds that schema into dataclasses-avroschema's model-generation feature; the bare string is emitted unquoted into a types.confixed annotation, and when the generated module is imported the embedded expression is evaluated, yielding arbitrary code execution in the developer's/build environment. No public exploit code is identified in the provided data.