CVE-2026-108380

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108380
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108380.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108380
Aliases
  • GHSA-g7p7-mgvm-jw7p
Published
2026-10-13T17:41:38Z
Modified
2026-10-15T02:47:24Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions
Details

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108380.json"
}
References

Affected packages

Git / github.com/marcosschroh/dataclasses-avroschema

Affected ranges

Type
GIT
Repo
https://github.com/marcosschroh/dataclasses-avroschema
Events
Introduced
5c882a95be50cf87acc5ba4f4ce8763d8cf76004
Fixed
de45de04f080e829c787a4b22eff92e5e632eaa1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.65.9"
        },
        {
            "fixed":  "0.70.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.65.10
0.65.11
0.65.12
0.65.13
0.65.14
0.65.9
0.66.0
0.66.1
0.66.2
0.66.3
0.66.4
0.67.0
0.68.0
0.68.1
0.69.0
0.69.1
0.70.0
0.70.1
0.70.2
0.70.3
0.70.4
0.70.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108380.json"