dataclasses-avroschema CVE-2026-108385

Exploitation requires an application to use the dataclasses-avroschema model-generator classes (e.g. BaseGenerator.parse_enum / EnumRepresentation.render_symbols) DIRECTLY on an attacker-controlled Avro schema, AND to subsequently import or execute the generated Python module. The malicious input is specifically an enum symbol containing newlines or punctuation that survives casefy case-conversion unchanged and is written into the enum class body. Limiting factors: this is not the default runtime serialization path (schema generation from trusted Python models is unaffected); the attacker must control the input schema; and the generated code must actually be run for impact. Versions 0.38.0 through 0.70.5 are affected; 0.70.6 validates every enum symbol as a Python identifier and removes the vector.

Signals are moderately aligned but not fully corroborated. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H → 8.8 High) reflects an unauthenticated code-injection flaw (CWE-94) with high impact to all three properties, and the vendor GitHub advisory (GHSA-gw6w-pvv9-2fqc) plus the fix commit confirm the root cause. However, no EPSS score, no CISA KEV entry, and no public POC were provided, so there is no evidence of real-world exploitation - this is a disclosed-and-patched issue rather than an actively weaponized one. The CVSS AV:N and the 'RCE' tag overstate everyday reach: the description explicitly scopes the flaw to 'when generator classes are used directly,' i.e. a developer/application must feed an untrusted Avro schema into the model-generator API and then import or execute the generated Python module. The injected content is also characterized as 'constrained statements' in an enum class body yielding 'namespace modification or preventing the module from loading,' which is narrower than classic arbitrary RCE. Net: a genuine code-injection bug worth patching, but real-world priority is tempered by the non-default usage pattern and absence of any exploitation telemetry - treat as medium operational priority unless your pipeline executes generated code from untrusted schemas.

A service accepts Avro schemas from an untrusted source and uses dataclasses-avroschema's model-generator classes to turn them into Python code, which it then imports or executes. An attacker submits a schema whose enum symbols contain newlines and punctuation, so after case conversion those symbols are emitted verbatim as code inside the generated enum class body. No public exploit code was identified at time of analysis; exploitation requires user/application interaction (UI:R) to run the generated module.