dataclasses-avroschema EUVD-2026-98962

Exploitation requires that an attacker control (or taint) the Avro schema's record 'name' value AND that a victim use the Python code-generation feature (Avro schema → Python model) on that schema and subsequently IMPORT the generated module - import is when the injected code runs. The realistic prerequisite is an untrusted or externally-sourced schema flowing into the generator (e.g., a shared/remote schema registry or attacker-supplied schema file); it does NOT trigger merely by producing Avro schemas from trusted dataclasses. Limiting factors: requires user interaction (running the generator and importing output), affects only versions 0.62.3 through 0.70.5, and has no impact if all consumed schemas are trusted. Not remotely exploitable against a running service by default - the attack surface is the code-generation/build pipeline.

This is a genuine high-severity code-injection flaw (CWE-94) but its real-world priority is moderated by the exploitation workflow rather than the raw 8.8 score. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) correctly captures that no authentication to the library is needed and complexity is low, but the UI:R component is load-bearing: a victim developer must run the Avro-schema-to-Python code generator on an attacker-influenced schema AND then import the generated module for code to execute. This is a developer-/build-tooling exposure, not an internet-facing server flaw, which tempers the 'network' framing. No EPSS score was provided and the CVE is NOT listed in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis' - the only exploit-relevant artifacts supplied are the vendor's own remediation commit diffs, which demonstrate the injection point but are not weaponized POC code. The absence of EPSS/KEV data means widespread or targeted exploitation cannot be confirmed either way. Net assessment: a real and clearly-exploitable injection in a code-generation path, but exploitation depends on an untrusted-schema supply chain into a niche library, so it is a 'patch promptly where used' issue rather than an emergency internet-wide priority. VERIFY: AV:N is defensible only if schemas are pulled from remote registries; if schemas are always local files, the practical vector is closer to local.

An attacker publishes or injects a malicious Avro schema (for example into a shared schema registry or a repository the target consumes) whose record 'name' value contains a crafted string that closes the quoted Meta.schema_name literal and appends arbitrary Python statements. A developer runs dataclasses-avroschema's model generator against that schema and imports the resulting module, at which point the injected statements execute in the developer's or CI environment. No public exploit code has been identified, though the fixing commit diffs clearly reveal the unescaped injection point.