CVE-2026-108375

Name of the Vulnerable Software and Affected Versions dataclasses-avroschema versions 0.38.0 through 0.70.5

Description The software generates Python code from Avro schemas. The FieldRepresentation.get field default() function inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in the generated Python source without proper escaping. An attacker can use a crafted default value to terminate the literal and inject arbitrary statements into the generated module, which are then executed when the module is imported.

Recommendations Update dataclasses-avroschema to version 0.70.6.