Dataclasses Avroschema
Monthly
Code injection in dataclasses-avroschema versions 0.38.0 through 0.70.5 lets an attacker who controls the Avro schema consumed by the library's model-generator classes inject arbitrary statements into the generated Python source, because enum symbols are used as generated enum member names after case conversion without being validated as Python identifiers. Exploitation is not on the library's default runtime serialization path: it requires an application to invoke the generator classes directly (BaseGenerator.parse_enum / EnumRepresentation.render_symbols) on an attacker-supplied schema and then import or execute the emitted module, which is why the assessed vector carries UI:R despite being network-reachable and unauthenticated (PR:N). Impact when the chain is completed is code execution and namespace modification in the importing process with high confidentiality, integrity, and availability consequences (CVSS 8.8); no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis. Version 0.70.6 fixes the issue by validating every enum symbol as a name.
Arbitrary code execution in dataclasses-avroschema versions 0.38.0 through 0.70.5, where BaseGenerator.parse_fixed writes a fixed type's 'aliases' value straight into the generated types.confixed annotation: a bare string alias (instead of a JSON list) is emitted as an unquoted Python expression and evaluated the moment the generated module is imported. Exploitation is not automatic - it requires a developer to run the library's Avro-schema-to-Python code generation over an attacker-influenced schema and then import the resulting module, which is why the vector carries UI:R despite PR:N and network-level delivery of the malicious schema. The flaw is a genuine CWE-94 code-injection issue with high confidentiality, integrity and availability impact under our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; no public exploit code has been identified at time of analysis and it is not in CISA KEV. Version 0.70.6 fixes it by rejecting any 'aliases' value that is not a list.
Code injection in dataclasses-avroschema 0.38.0 through 0.70.5 allows an attacker who supplies a crafted Avro schema to the library's Avro-to-Python code generator (model_generator) to embed arbitrary Python statements into the generated module via an enum field default, and those statements execute when the generated module is imported, either modifying the module namespace or preventing it from loading (CVSS 3.1 8.8, CWE-94). The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is unauthenticated but requires user interaction: a victim must run the generator against the attacker-controlled schema and then import the resulting module, so environments that only generate code from their own trusted models or never load attacker-influenced generated code are not exposed. The maintainer confirmed and patched the issue in 0.70.6 by validating enum defaults as names; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed (CISA KEV) at the time of writing.
Python code injection in dataclasses-avroschema versions 0.38.0 through 0.70.5 lets an attacker with control over Avro schema content smuggle arbitrary Python statements into the enum class body that the library emits, so simply importing the generated module executes the attacker's code. The flaw sits in EnumRepresentation.render_symbols, which wraps each schema-supplied enum symbol in double quotes without escaping it, allowing a quote character to close the literal and append attacker-chosen Python. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8, CWE-94) indicates no privileges are required but that user interaction is essential, since the victim must run the import of the generated file; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, and version 0.70.6 fixes it by escaping enum symbol values before rendering.
Arbitrary Python code execution in dataclasses-avroschema versions 0.44.0 through 0.70.5 occurs because the Pydantic and AvroDantic model generators embed an Avro schema field's pydantic-class value directly into a generated field annotation after the literal prefix 'pydantic.', without sanitizing the expression. When a victim runs the code-generation path (ModelGenerator) on an attacker-influenced schema and then imports the generated Python module, the injected annotation is evaluated at import time and the payload executes with the privileges of that process, giving full confidentiality and integrity impact (CVSS 8.8, AV:C:N/AC:L/PR:N/UI:R). Exploitation is unauthenticated from the network perspective (CVSS PR:N) but requires the victim to generate and import the code, and no public exploit code or CISA KEV entry was identified at time of analysis; version 0.70.6 restricts the value to a bare name or a call to a bare name with literal arguments.
Arbitrary Python code execution is possible in dataclasses-avroschema versions 0.65.9 through 0.70.5 when the library's Pydantic or AvroDantic model-generation path is run over an Avro schema the attacker controls: the schema field's 'doc' value is interpolated unescaped between the quotes of a generated pydantic.Field(description="...") argument, so a crafted quote can close the string and inject a Python expression that is evaluated when the generated class is defined (CWE-94). The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8), reflecting high confidentiality and integrity impact with user interaction required because a developer or build process must actively generate models from the malicious schema; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and urgency is further moderated because only the Pydantic/AvroDantic generators are affected and only versions 0.65.9-0.70.5 are vulnerable.
Code injection in dataclasses-avroschema 0.38.0 through 0.70.5 lets an attacker-influenced Avro schema execute arbitrary Python when the library's model generator renders a 'fixed' type's namespace into generated source. BaseGenerator.parse_fixed interpolates the namespace between quotes inside a generated types.confixed annotation without escaping, so a namespace containing a quote character terminates the string literal and turns the remainder into live Python that runs when the generated class is defined or the generated module is imported; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8), unauthenticated over the network but requiring the victim to run code generation on the crafted schema and then import the result. The flaw is fixed in 0.70.6, which enforces that namespaces are dot-separated sequences of valid Avro names; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the high CVSS score, confirmed GHSA-h9q3-f96w-f88j advisory, and availability of a vendor fix commit make prompt upgrading advisable for anyone generating code from externally sourced schemas.
Code injection in dataclasses-avroschema versions 0.40.0 through 0.70.5 lets an attacker who controls the `doc` value of an Avro schema record close the generated class docstring and inject arbitrary Python statements into the emitted class body, achieving code execution when the generated module is imported. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) rates the flaw as network-reachable, low-complexity and unauthenticated with high confidentiality and integrity impact, but exploitation is gated by user interaction: a developer or CI pipeline must both run the library's model generator against the attacker-influenced schema and import the resulting Python file. No public exploit code has been identified at time of analysis, and the vendor released a fix in 0.70.6.
Code injection in dataclasses-avroschema 0.62.3 through 0.70.5 allows an attacker-supplied Avro record name to break out of the quoted Meta.schema_name string literal and inject arbitrary Python statements into the generated model's class body, which then execute when that generated module is imported. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) means no authentication is required but a victim must run the Avro-to-Python code generator on an untrusted or tainted schema and subsequently import the generated file; generating Avro schemas from trusted local dataclasses does not trigger it. Vendor-released patch: 0.70.6. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV entry).
Code injection in dataclasses-avroschema versions 0.38.0 through 0.70.5 allows remote, unauthenticated attackers who supply a crafted Avro schema to inject constrained Python statements into the module produced by the schema-to-code generator; the injected code executes when that generated module is imported. Exploitation requires the victim to deliberately process an untrusted schema through the avro-to-code path and then import the resulting module (the UI:R gate), which limits exposure to pipelines that ingest third-party schemas. CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; no public exploit identified at time of analysis, and version 0.70.6 fixes the flaw by validating enum defaults as names.
Arbitrary code execution in dataclasses-avroschema 0.38.0 through 0.70.5 occurs when the library's Avro-to-Python model generator processes a schema containing a fixed type whose 'aliases' value is a bare string instead of a list; the value is interpolated unquoted into a generated 'types.confixed' annotation and evaluated when the generated module is imported, giving an attacker code execution in the victim's Python process. Exploitation is unauthenticated from the network perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but gated on victim interaction: someone must run the schema-to-code generation path on attacker-controlled schema content and then import the resulting module. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a high-severity but precondition-gated code-injection flaw; the vendor released 0.70.6, which rejects non-list aliases.
Code injection in dataclasses-avroschema versions 0.38.0 through 0.70.5 lets an attacker who controls the Avro schema consumed by the library's model-generator classes inject arbitrary statements into the generated Python source, because enum symbols are used as generated enum member names after case conversion without being validated as Python identifiers. Exploitation is not on the library's default runtime serialization path: it requires an application to invoke the generator classes directly (BaseGenerator.parse_enum / EnumRepresentation.render_symbols) on an attacker-supplied schema and then import or execute the emitted module, which is why the assessed vector carries UI:R despite being network-reachable and unauthenticated (PR:N). Impact when the chain is completed is code execution and namespace modification in the importing process with high confidentiality, integrity, and availability consequences (CVSS 8.8); no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis. Version 0.70.6 fixes the issue by validating every enum symbol as a name.
Arbitrary code execution in dataclasses-avroschema versions 0.38.0 through 0.70.5, where BaseGenerator.parse_fixed writes a fixed type's 'aliases' value straight into the generated types.confixed annotation: a bare string alias (instead of a JSON list) is emitted as an unquoted Python expression and evaluated the moment the generated module is imported. Exploitation is not automatic - it requires a developer to run the library's Avro-schema-to-Python code generation over an attacker-influenced schema and then import the resulting module, which is why the vector carries UI:R despite PR:N and network-level delivery of the malicious schema. The flaw is a genuine CWE-94 code-injection issue with high confidentiality, integrity and availability impact under our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; no public exploit code has been identified at time of analysis and it is not in CISA KEV. Version 0.70.6 fixes it by rejecting any 'aliases' value that is not a list.
Code injection in dataclasses-avroschema 0.38.0 through 0.70.5 allows an attacker who supplies a crafted Avro schema to the library's Avro-to-Python code generator (model_generator) to embed arbitrary Python statements into the generated module via an enum field default, and those statements execute when the generated module is imported, either modifying the module namespace or preventing it from loading (CVSS 3.1 8.8, CWE-94). The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is unauthenticated but requires user interaction: a victim must run the generator against the attacker-controlled schema and then import the resulting module, so environments that only generate code from their own trusted models or never load attacker-influenced generated code are not exposed. The maintainer confirmed and patched the issue in 0.70.6 by validating enum defaults as names; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed (CISA KEV) at the time of writing.
Python code injection in dataclasses-avroschema versions 0.38.0 through 0.70.5 lets an attacker with control over Avro schema content smuggle arbitrary Python statements into the enum class body that the library emits, so simply importing the generated module executes the attacker's code. The flaw sits in EnumRepresentation.render_symbols, which wraps each schema-supplied enum symbol in double quotes without escaping it, allowing a quote character to close the literal and append attacker-chosen Python. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8, CWE-94) indicates no privileges are required but that user interaction is essential, since the victim must run the import of the generated file; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, and version 0.70.6 fixes it by escaping enum symbol values before rendering.
Arbitrary Python code execution in dataclasses-avroschema versions 0.44.0 through 0.70.5 occurs because the Pydantic and AvroDantic model generators embed an Avro schema field's pydantic-class value directly into a generated field annotation after the literal prefix 'pydantic.', without sanitizing the expression. When a victim runs the code-generation path (ModelGenerator) on an attacker-influenced schema and then imports the generated Python module, the injected annotation is evaluated at import time and the payload executes with the privileges of that process, giving full confidentiality and integrity impact (CVSS 8.8, AV:C:N/AC:L/PR:N/UI:R). Exploitation is unauthenticated from the network perspective (CVSS PR:N) but requires the victim to generate and import the code, and no public exploit code or CISA KEV entry was identified at time of analysis; version 0.70.6 restricts the value to a bare name or a call to a bare name with literal arguments.
Arbitrary Python code execution is possible in dataclasses-avroschema versions 0.65.9 through 0.70.5 when the library's Pydantic or AvroDantic model-generation path is run over an Avro schema the attacker controls: the schema field's 'doc' value is interpolated unescaped between the quotes of a generated pydantic.Field(description="...") argument, so a crafted quote can close the string and inject a Python expression that is evaluated when the generated class is defined (CWE-94). The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8), reflecting high confidentiality and integrity impact with user interaction required because a developer or build process must actively generate models from the malicious schema; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and urgency is further moderated because only the Pydantic/AvroDantic generators are affected and only versions 0.65.9-0.70.5 are vulnerable.
Code injection in dataclasses-avroschema 0.38.0 through 0.70.5 lets an attacker-influenced Avro schema execute arbitrary Python when the library's model generator renders a 'fixed' type's namespace into generated source. BaseGenerator.parse_fixed interpolates the namespace between quotes inside a generated types.confixed annotation without escaping, so a namespace containing a quote character terminates the string literal and turns the remainder into live Python that runs when the generated class is defined or the generated module is imported; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8), unauthenticated over the network but requiring the victim to run code generation on the crafted schema and then import the result. The flaw is fixed in 0.70.6, which enforces that namespaces are dot-separated sequences of valid Avro names; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the high CVSS score, confirmed GHSA-h9q3-f96w-f88j advisory, and availability of a vendor fix commit make prompt upgrading advisable for anyone generating code from externally sourced schemas.
Code injection in dataclasses-avroschema versions 0.40.0 through 0.70.5 lets an attacker who controls the `doc` value of an Avro schema record close the generated class docstring and inject arbitrary Python statements into the emitted class body, achieving code execution when the generated module is imported. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) rates the flaw as network-reachable, low-complexity and unauthenticated with high confidentiality and integrity impact, but exploitation is gated by user interaction: a developer or CI pipeline must both run the library's model generator against the attacker-influenced schema and import the resulting Python file. No public exploit code has been identified at time of analysis, and the vendor released a fix in 0.70.6.
Code injection in dataclasses-avroschema 0.62.3 through 0.70.5 allows an attacker-supplied Avro record name to break out of the quoted Meta.schema_name string literal and inject arbitrary Python statements into the generated model's class body, which then execute when that generated module is imported. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) means no authentication is required but a victim must run the Avro-to-Python code generator on an untrusted or tainted schema and subsequently import the generated file; generating Avro schemas from trusted local dataclasses does not trigger it. Vendor-released patch: 0.70.6. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV entry).
Code injection in dataclasses-avroschema versions 0.38.0 through 0.70.5 allows remote, unauthenticated attackers who supply a crafted Avro schema to inject constrained Python statements into the module produced by the schema-to-code generator; the injected code executes when that generated module is imported. Exploitation requires the victim to deliberately process an untrusted schema through the avro-to-code path and then import the resulting module (the UI:R gate), which limits exposure to pipelines that ingest third-party schemas. CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; no public exploit identified at time of analysis, and version 0.70.6 fixes the flaw by validating enum defaults as names.
Arbitrary code execution in dataclasses-avroschema 0.38.0 through 0.70.5 occurs when the library's Avro-to-Python model generator processes a schema containing a fixed type whose 'aliases' value is a bare string instead of a list; the value is interpolated unquoted into a generated 'types.confixed' annotation and evaluated when the generated module is imported, giving an attacker code execution in the victim's Python process. Exploitation is unauthenticated from the network perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but gated on victim interaction: someone must run the schema-to-code generation path on attacker-controlled schema content and then import the resulting module. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a high-severity but precondition-gated code-injection flaw; the vendor released 0.70.6, which rejects non-list aliases.