CVE-2026-108383: dataclasses-avroschema enum field defaults can inject statements into generated modules
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.getfielddefault renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dataclasses-avroschemato a version that resolves this vulnerability.Fixed in 0.70.6
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using dataclasses-avroschema versions 0.38.0 through 0.70.5 are exposed when they generate Python code from an Avro schema containing a crafted enum field default. The affected code path renders the enum default into a generated Python module.
What does an attacker need to exploit this?
An attacker needs to control, or cause a target to process, an Avro schema with a malicious enum field default. Exploitation also requires the vulnerable library to generate the Python module from that schema; the issue is triggered by schema-controlled input rather than authentication.
What can the injected content do?
The crafted default can escape the intended enum-member reference and inject constrained statements into the generated module. This can modify the module namespace or prevent the generated module from loading.
What should be done if upgrading is not immediately possible?
Do not generate Python code from untrusted Avro schemas, and review or validate enum field defaults before they reach the generation process. In particular, reject defaults containing characters that are not valid Python identifiers.
How can teams determine whether they may already be affected?
Identify installations running versions 0.38.0 through 0.70.5 and review Avro schemas used for Python code generation. Inspect enum field defaults for newlines, operators, punctuation, or other values that would not be valid names, and review generated modules for unexpected statements or load failures.