CVE-2026-108380

Name of the Vulnerable Software and Affected Versions dataclasses-avroschema versions 0.65.9 through 0.70.5

Description The PydanticFieldRepresentation.add field properties() function fails to escape the documentation value of a schema field when inserting it into the description argument of a generated pydantic.Field. A specially crafted quote can terminate the string and inject an expression that is evaluated during the generated class definition, leading to arbitrary Python code execution during Pydantic and AvroDantic model generation.

Recommendations Update to version 0.70.6.