Read the docs
TI-2026-71970 Aliases CVE-2026-108384

Code injection in dataclasses-avroschema via bare string aliases

Priority MEDIUM 40CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

dataclasses-avroschema from 0.38.0 before 0.70.6 is affected. The BaseGenerator.parse_fixed method inserts a fixed type's aliases value into generated code unquoted when it is a bare string, which is a code injection flaw (CWE-94). A remote attacker with no privileges can run arbitrary code when a user imports a module generated from a crafted schema.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00343 27th percentileScored 2026-11-07
Fix Fixed dataclasses-avroschema (marcosschroh): 0.70.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
marcosschrohdataclasses-avroschema0.38.0 to before 0.70.60.70.6Patch availableCNA
  • dataclasses-avroschema Vendormarcosschroh Affected 0.38.0 to before 0.70.6 Fixed in 0.70.6 Patch available CNA

Remediation

Upgrade dataclasses-avroschema to version 0.70.6, which rejects aliases values that are not lists.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA dataclasses-avroschema (marcosschroh) Fixed in 0.70.6

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-108384
  2. 2026-10-13 CISA SSVC decision points changed
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-14 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-71971 Code injection in dataclasses-avroschema enum generation CVSS 3.1HIGH 8.8
  • TI-2026-71968 Code injection in dataclasses-avroschema through enum symbol literals CVSS 3.1HIGH 8.8
  • TI-2026-71967 Code injection in dataclasses-avroschema Pydantic model generation CVSS 3.1HIGH 8.8
  • TI-2026-71966 Code injection in dataclasses-avroschema Pydantic field documentation CVSS 3.1HIGH 8.8
  • TI-2026-71964 Code injection in dataclasses-avroschema generated class docstrings CVSS 3.1HIGH 8.8
  • TI-2026-71963 Code injection in dataclasses-avroschema through Meta.schema_name CVSS 3.1HIGH 8.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences