CLEANSTART-2026-NU68089: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas
Published Nov 13, 2026
·Updated
Security vulnerability affects the spark-sc213-jdk17-py312 package. Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
Affected Software
1 affected componentFixes available
cleanstart/spark-sc213-jdk17-py312<4.0.5-r0
4.0.5-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/spark-sc213-jdk17-py312to a version that resolves this vulnerability.Fixed in 4.0.5-r0
Event History
Nov 13, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does the reported attack vector require authentication or user interaction?
No. The supplied CVSS vector indicates network attackability with low attack complexity, no privileges required, and no user interaction required.
2
Which security properties may be affected if exploitation succeeds?
The supplied CVSS vector indicates low impacts to confidentiality, integrity, and availability.