CVE-2026-108379

Name of the Vulnerable Software and Affected Versions dataclasses-avroschema versions 0.38.0 through 0.70.5

Description The BaseGenerator.parse fixed() function inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without proper escaping or validation. An attacker can use a crafted quote to terminate the namespace string and modify the surrounding annotation expression. Since Python evaluates this expression when the generated class is defined, this can lead to arbitrary code execution.

Recommendations Update to version 0.70.6.