CVE-2026-108383

Name of the Vulnerable Software and Affected Versions dataclasses-avroschema versions 0.38.0 through 0.70.5

Description The software generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records, and also generates Python code from Avro schemas. The get field default() function within FieldRepresentation renders a schema-controlled enum field default as an enum member reference after case conversion without validating it as an identifier. This allows newlines, operators, and punctuation to escape the intended reference and inject constrained statements into the generated module, which can lead to namespace modification or prevent the module from loading.

Recommendations Update dataclasses-avroschema to version 0.70.6.