PT-2026-111790 · Git+1 · Dataclasses-Avroschema
CVE-2026-108381
·
Published
2026-10-13
·
Updated
2026-10-13
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
dataclasses-avroschema versions 0.44.0 through 0.70.5
Description
The Pydantic and AvroDantic model generators insert a schema field's
pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Since annotations are evaluated during the import of the generated module, a crafted value can lead to the execution of arbitrary Python code.Recommendations
Update dataclasses-avroschema to version 0.70.6.
Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dataclasses-Avroschema