EUVD-2026-98977Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted Avro schema with malicious pydantic-class value
-
DeliveryVictim runs Pydantic/AvroDantic model generator
-
ExploitPayload inserted into generated field annotation
-
ExecutionGenerated module imported, annotation evaluated
-
ImpactArbitrary Python code executes in victim context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim use the Pydantic or AvroDantic model generator (ModelGenerator) feature to generate Python code from an attacker-influenced Avro schema, specifically a schema field carrying a pydantic-class value, and then import the generated module (annotations are evaluated at import). Affected versions are 0.44.0 through 0.70.5. Limiting factors: the attacker must control or taint the input Avro schema, the victim must actively run code generation and execute/import the output (UI:R), and users who only consume the library's schema-generation-from-dataclasses direction or who never process untrusted schemas are not exposed; upgrading to 0.70.6 restricts the value to a bare name or a call to a bare name with literal arguments. |
| Impact | This is a genuine high-severity code-execution flaw (CWE-94) rather than inflated CVSS noise, but its real-world priority is tempered by the exploitation model. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) correctly captures that no privileges are needed and impact is full RCE, but the UI:R flag is the decisive mitigant: a victim must actively feed an attacker-controlled Avro schema into the Pydantic/AvroDantic model generator AND then import the generated module. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit is referenced - so there is no signal of active or automatable exploitation. The absence of these does not mean the issue is low risk, only that exploitation appears opportunistic/targeted rather than mass-scanned. Net: treat as a prompt patch-and-upgrade item for anyone running untrusted Avro schemas through the generator, but it is not a drive-by internet-facing threat like an unauthenticated server RCE. |
| Exploit ScenarioDerived | An attacker publishes or supplies a malicious Avro schema containing a crafted pydantic-class value in a field definition. A developer or pipeline uses dataclasses-avroschema's Pydantic/AvroDantic model generator (version 0.44.0-0.70.5) to generate Python models from that schema and imports the resulting module; the crafted value is evaluated as a field annotation at import time, executing arbitrary Python code in the victim's context. No public exploit code is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Arbitrary Python code execution in dataclasses-avroschema versions 0.44.0 through 0.70.5 occurs because the Pydantic and AvroDantic model generators embed an Avro schema field's pydantic-class value directly into a generated field annotation after the literal prefix 'pydantic.', without sanitizing the expression. When a victim runs the code-generation path (ModelGenerator) on an attacker-influenced schema and then imports the generated Python module, the injected annotation is evaluated at import time and the payload executes with the privileges of that process, giving full confidentiality and integrity impact (CVSS 8.8, AV:C:N/AC:L/PR:N/UI:R). Exploitation is unauthenticated from the network perspective (CVSS PR:N) but requires the victim to generate and import the code, and no public exploit code or CISA KEV entry was identified at time of analysis; version 0.70.6 restricts the value to a bare name or a call to a bare name with literal arguments.
RemediationAI
Vendor-released patch: upgrade to dataclasses-avroschema 0.70.6, which restricts the injected pydantic-class value to a bare name or a call to a bare name with literal arguments and eliminates the arbitrary-expression path. See the release notes at https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6, the fixing PR at https://github.com/marcosschroh/dataclasses-avroschema/pull/358, and commit 429f3d705d2d04c0c65e2ef832daed5ff91318fc, plus the advisory at https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-4jmx-9m83-vxx8. If immediate upgrade is not possible, stop invoking ModelGenerator (the Pydantic/AvroDantic code-generation feature) on any Avro schema that has not been fully vetted as trusted, since the flaw only triggers during code generation and subsequent import of the generated module; restricting generation to first-party schemas removes the tainted-input precondition at the cost of losing the schema-to-Python capability entirely. As a defense-in-depth control, always inspect or sandbox generated modules before import and never generate or auto-import Python from schemas crossing a trust boundary (e.g., from message brokers, user uploads, or third-party registries) - this does not fix the underlying injection but contains its effect if a tainted schema still reaches the generator. Note that the library's schema-generation-from-dataclasses direction and workloads that never process untrusted schemas are not exposed, so no patch urgency applies to those deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
dataclasses-avroschema is a Python library that converts Python dataclasses, Pydantic models, and Faust Records into Avro schemas and, in the reverse direction, generates Python code from Avro schemas. The vulnerable component is the model-generation side: the Pydantic and AvroDantic generators emit field annotations of the form 'pydantic.<value>', where <value> is taken from the Avro schema's pydantic-class attribute. Because Python evaluates annotations at module import time (absent 'from __future__ import annotations'), a crafted value is executed as live Python rather than treated as inert metadata. This is a classic CWE-94 code-injection defect: untrusted input is concatenated into a code template without validation or escaping, turning data into executable statements. The fix in 0.70.6 (PR #358, commit 429f3d705d2d04c0c65e2ef832daed5ff91318fc) constrains the value to a bare identifier or a call to a bare identifier with literal arguments, which prevents arbitrary expressions from being evaluated. The affected CPE (cpe:2.3:a:marcosschroh:dataclasses-avroschema:*:*:*:*:*:*:*:*) covers the package across all platforms and architectures; parsing/serialization of trusted schemas is not the attack surface - only the code-generation-then-import workflow is.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker-supplied schema can arrive over the network (AV:N) with no privileges (PR:N), but the victim must actively run codegen and import the output (UI:R), yielding full RCE impact (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.
Articles & Coverage 1
Technical POC Analysis
No patch diff text was supplied.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
dataclasses-avroschema versions 0.44.0 through 0.70.5 allow arbitrary Python code execution when a victim generates and imports Pydantic models from an attacker-influenced Avro schema. This unauthenticated network-exploitable flaw requires user interaction to import the generated module, and it can fully compromise the confidentiality and integrity of any affected process. Leadership should prioritize mitigation because developers and production services that process untrusted schemas could face data breach or system takeover.
No vendor-released patch identified; restrict use of ModelGenerator to trusted schemas, avoid importing generated modules from untrusted sources, validate and sanitize Avro schema fields, run code generation in isolated environments with least privilege, and monitor for anomalous execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB