TI-2026-71969 Aliases CVE-2026-108383

Code injection in dataclasses-avroschema enum field defaults

MEDIUM 40CWE-94Published 2026-10-13 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

dataclasses-avroschema from 0.38.0 through 0.70.5 renders schema-controlled enum field defaults into generated Python modules without validating them as identifiers. This is improper control of code generation (CWE-94), so newlines, operators, and punctuation in a default can inject statements into the generated module. An attacker who supplies a crafted Avro schema can modify namespaces or stop the module from loading, and a user must take action to generate code from it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00287 21st percentileScored 2026-11-07

Fix Fixed dataclasses-avroschema (marcosschroh): 0.70.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
marcosschroh	dataclasses-avroschema	0.38.0 to before 0.70.6	0.70.6	Patch available	CNA

dataclasses-avroschema Vendormarcosschroh Affected 0.38.0 to before 0.70.6 Fixed in 0.70.6 Patch available CNA

Remediation

Upgrade dataclasses-avroschema to version 0.70.6, which validates enum defaults as names.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Fix · CNA dataclasses-avroschema (marcosschroh) Fixed in 0.70.6

Timeline

2026-10-13 Threatist record created from CVE-2026-108383
2026-10-14 CISA SSVC decision points changed

References

Other 3

TI-2026-71971 Code injection in dataclasses-avroschema enum generation CVSS 3.1HIGH 8.8
TI-2026-71968 Code injection in dataclasses-avroschema through enum symbol literals CVSS 3.1HIGH 8.8
TI-2026-71967 Code injection in dataclasses-avroschema Pydantic model generation CVSS 3.1HIGH 8.8
TI-2026-71966 Code injection in dataclasses-avroschema Pydantic field documentation CVSS 3.1HIGH 8.8
TI-2026-71964 Code injection in dataclasses-avroschema generated class docstrings CVSS 3.1HIGH 8.8
TI-2026-71963 Code injection in dataclasses-avroschema through Meta.schema_name CVSS 3.1HIGH 8.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences