EUVD-2026-98976Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted Avro schema with malicious doc
-
DeliveryVictim runs Pydantic/AvroDantic model generation
-
ExploitQuote terminates description string
-
ExecutionInjected expression evaluated at class definition
-
ImpactArbitrary Python code execution in generator process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim invoke dataclasses-avroschema's Pydantic or AvroDantic model-generation path on an Avro schema the attacker controls, where the schema includes a 'doc' attribute on a field; the doc value is inserted unescaped between the quotes of a generated pydantic.Field(description="...") argument, so a crafted quote closes the string and injects a Python expression evaluated when the generated class is defined. Limiting factors: only versions 0.65.9 through 0.70.5 are affected (fixed in 0.70.6); only the Pydantic and AvroDantic generators are vulnerable (plain dataclass and Faust generation do not render the doc as a Field description); and exploitation depends on the user actively running code generation over an untrusted or externally-sourced schema rather than any always-on network service. |
| Impact | The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a genuine arbitrary-code-execution flaw (CWE-94), but real-world urgency is tempered by the exploitation model: this is a developer/build-time code-generation library, and the malicious input is an Avro schema whose 'doc' field breaks out of a generated pydantic.Field description string. The AV:N rating is defensible because Avro schemas are frequently pulled from shared schema registries or other systems, yet the practical trigger is a victim choosing to run Pydantic/AvroDantic model generation over an attacker-controlled schema (hence UI:R), so this is not a remotely-sprayable server exploit. No EPSS score, KEV listing, SSVC decision, or public POC is present in the provided intelligence - the only exploit-relevant artifacts are the fix PR, fix commit, and 0.70.6 release. Exploitation status: no public exploit identified at time of analysis. Net: a real code-injection bug worth patching promptly in any pipeline that generates code from untrusted or externally-sourced Avro schemas, but closer to a supply-chain/build-tooling risk than a mass-exploited internet-facing CVE, and the headline 8.8 overstates the likelihood of opportunistic widespread exploitation. |
| Exploit ScenarioDerived | An attacker publishes or submits an Avro schema whose field 'doc' value contains a crafted double-quote followed by a Python expression that closes the description string and appends an evaluated call. When a developer or automated pipeline runs dataclasses-avroschema's Pydantic or AvroDantic model generation on that schema, the injected expression is evaluated during generated class definition, executing arbitrary Python in the generating process. No public POC is referenced in the provided data, but the mechanism is fully confirmed by the fix diff. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Arbitrary Python code execution is possible in dataclasses-avroschema versions 0.65.9 through 0.70.5 when the library's Pydantic or AvroDantic model-generation path is run over an Avro schema the attacker controls: the schema field's 'doc' value is interpolated unescaped between the quotes of a generated pydantic.Field(description="...") argument, so a crafted quote can close the string and inject a Python expression that is evaluated when the generated class is defined (CWE-94). The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8), reflecting high confidentiality and integrity impact with user interaction required because a developer or build process must actively generate models from the malicious schema; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and urgency is further moderated because only the Pydantic/AvroDantic generators are affected and only versions 0.65.9-0.70.5 are vulnerable.
RemediationAI
Vendor-released patch: upgrade dataclasses-avroschema to 0.70.6 or later (release tag https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6, fix commit 429f3d705d2d04c0c65e2ef832daed5ff91318fc, PR https://github.com/marcosschroh/dataclasses-avroschema/pull/843; advisory GHSA-g7p7-mgvm-jw7p), which escapes the Avro 'doc' value before rendering it into the generated pydantic.Field description and routes the AvroDantic generator through the same safe representation class. Where upgrading is not immediately possible, treat Avro schemas from untrusted or externally sourced registries as hostile input to the Pydantic/AvroDantic generators: run model generation only in an isolated, low-privilege sandbox or disposable container with no credentials, network egress, or secrets mounted, since any tooling that still evaluates the generated class body will execute injected expressions; strip or reject the 'doc' attribute on fields (or sanitize/escape double quotes and backslashes in it) before generation, at the cost of losing field documentation in the generated models; and gate generation behind schema review or a trusted schema registry rather than consuming arbitrary schema files. Note that these are compensating controls with trade-offs (reduced documentation fidelity, added build complexity) and do not substitute for the 0.70.6 upgrade; no public exploit code has been identified at time of analysis, but the exploitation model - developer or CI invoking code generation on an attacker-influenced schema - means build pipelines and code-generation services should be prioritized for the update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
dataclasses-avroschema is a Python library that converts Python dataclasses, Pydantic models, and Faust Records into Avro schemas and, in the opposite direction, generates Python source code from an Avro schema. The vulnerable component is the model generator under model_generator/lang/python, specifically PydanticFieldRepresentation.add_field_properties, which builds the source text for each generated field. When an Avro field carries metadata containing 'doc', that value is rendered directly as description="{doc}" with no escaping of embedded quote characters or other Python-significant syntax. Because the generated source is subsequently compiled and its class body evaluated (the pydantic.Field(...) argument expression is evaluated during class definition), an attacker-supplied doc string such as one that closes the quote and appends arbitrary expressions is executed as Python code in the context of whoever runs the generator. The root-cause class is CWE-94 (Improper Control of Generation of Code / Code Injection), i.e. unsafe string interpolation into generated source rather than a memory-safety or deserialization flaw. The upstream fix (PR #843, commit 429f3d705d2d04c0c65e2ef832daed5ff91318fc, release 0.70.6) introduces PydanticFieldRepresentation with an escaping-aware get_field_metadata/add_field_properties override and wires field_representation_class into BaseGenerator so the AvroDantic generator also uses the same safe representation; the CPE record cpe:2.3:a:marcosschroh:dataclasses-avroschema:*:*:*:*:*:*:*:* identifies the package as the affected artifact.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker needs no privileges and supplies a schema that may arrive over the network (AV:N), but the victim must actively run model generation on it (UI:R), yielding full code execution (C/I/A:H, scope unchanged).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.
Articles & Coverage 1
Technical POC Analysis
Advisory: GHSA-g7p7-mgvm-jw7p (marcosschroh/dataclasses-avroschema).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The dataclasses-avroschema library, versions 0.65.9 through 0.70.5, contains a code injection vulnerability (CVE-2026-108380) that allows unauthenticated attackers to execute arbitrary Python code when a developer or build process generates models from a malicious Avro schema. This could lead to supply chain compromise, data breaches, and loss of integrity in affected development environments. Leadership should prioritize remediation because the library is a common dependency in data pipelines and model generation workflows, though no public exploit identified at time of analysis and exploitation requires user interaction.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Restrict Avro schema processing to trusted sources and never process attacker-controlled schemas. (2) Implement input validation to escape or reject quotes and special characters in the 'doc' field before model generation. (3) Downgrade to a dataclasses-avroschema version prior to 0.65.9, if compatible. (4) Monitor vendor advisory for a patch and apply immediately when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB