CVE-2026-108382

Name of the Vulnerable Software and Affected Versions dataclasses-avroschema versions 0.38.0 through 0.70.5

Description The EnumRepresentation.render symbols() function concatenates schema-controlled enum symbols between double quotes during the generation of enum assignments. When generator classes are used directly, a quote character can terminate the string literal, allowing the injection of arbitrary Python code into the enum class body. This injected code executes automatically when the generated module is imported.

Recommendations Update to version 0.70.6.