CVE-2026-108375
CVE-2026-108375
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.
Vulnerability class: RCE (Remote Code Execution)
Published .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Weakness classification (CWE)
References
- github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-9h8h-26…
- https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc
- github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6
- github.com/marcosschroh/dataclasses-avroschema/commit/01e6d5e15ab0ff69faac39a34…
Frequently asked questions
- What is CVE-2026-108375?
- CVE-2026-108375 is a high-severity vulnerability, classified under Code Injection. CVSS score: 8.8/10. Published 2026-10-13.
- How severe is CVE-2026-108375?
- High severity. CVSS v3 base score is 8.8 out of 10.