CVE-2026-108378: dataclasses-avroschema record documentation can terminate generated class docstrings
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted class docstring without escaping quotes or backslashes. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, while a trailing backslash can escape the generated closing delimiter, allowing Python code execution during module import. Version 0.70.6 fixes the vulnerability by escaping quotes, backslashes, and unsafe control characters before rendering docstrings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dataclasses-avroschemato a version that resolves this vulnerability.Fixed in 0.70.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of dataclasses-avroschema versions 0.40.0 through 0.70.5 are exposed when they generate Python code from Avro schemas containing record-level doc values and later import the generated module. The risk is especially relevant where schemas can be supplied or modified by untrusted parties.
What does an attacker need to exploit it?
An attacker needs to place a crafted value in an Avro schema record's doc field. The generated Python code must then be imported, at which point injected statements in the generated class body can execute.
Is user interaction required?
Yes. The supplied vector indicates user interaction is required, and the described execution occurs when someone imports a module generated from the crafted schema.
What should teams do if they cannot upgrade immediately?
Do not generate and import Python modules from untrusted Avro schemas, particularly schemas with record doc fields. Review generated code before importing it and avoid processing crafted documentation values containing triple quotes or trailing backslashes.
How can I determine whether I may be affected?
Check whether your installed dataclasses-avroschema version falls between 0.40.0 and 0.70.5 and whether your workflow generates Python code from Avro schemas. Inspect record doc values and already-generated Python modules for unexpected statements near generated class docstrings.