CVE-2026-108385

Name of the Vulnerable Software and Affected Versions dataclasses-avroschema versions 0.38.0 through 0.70.5

Description The software generates Python code from Avro schemas. The parse enum() function in BaseGenerator and the render symbols() function in EnumRepresentation use schema-controlled enum symbols as generated enum member names after case conversion without validating them as identifiers. When generator classes are used directly, the inclusion of newlines and punctuation can allow the injection of constrained statements into the generated enum class body, which may lead to namespace modification or prevent the module from loading.

Recommendations Update dataclasses-avroschema to version 0.70.6.