CVE-2026-108384

Name of the Vulnerable Software and Affected Versions dataclasses-avroschema versions 0.38.0 through 0.70.5

Description The BaseGenerator.parse fixed() function interpolates the aliases value of a fixed type directly into a generated types.confixed annotation. While lists are handled with quoted entries, a bare string is emitted as an unquoted Python expression. This expression is evaluated when the generated module is imported, which can lead to arbitrary code execution if a crafted schema is used.

Recommendations Update to version 0.70.6.