CVE-2026-108384

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108384
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108384.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108384
Aliases
  • GHSA-8j5c-xq6f-2c43
Published
2026-10-13T17:53:48Z
Modified
2026-10-28T02:30:50Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string
Details

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108384.json"
}
References

Affected packages

Git / github.com/marcosschroh/dataclasses-avroschema

Affected ranges

Type
GIT
Repo
https://github.com/marcosschroh/dataclasses-avroschema
Events
Introduced
3024363f89b8799aacd15cd0bffcaa52c6972387
Fixed
de45de04f080e829c787a4b22eff92e5e632eaa1
Fixed
429f3d705d2d04c0c65e2ef832daed5ff91318fc
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.38.0"
                },
                {
                    "fixed": "0.70.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "429f3d705d2d04c0c65e2ef832daed5ff91318fc"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "0.70.6",
            "range": [
                {
                    "fixed": "de45de04f080e829c787a4b22eff92e5e632eaa1"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.38.0
0.38.1
0.39.0
0.39.1
0.39.2
0.39.3
0.40.0
0.41.0
0.41.1
0.41.2
0.42.0
0.42.1
0.42.2
0.43.0
0.43.1
0.43.10
0.43.2
0.43.3
0.43.4
0.43.5
0.43.6
0.43.7
0.43.8
0.43.9
0.44.0
0.45.0
0.45.1
0.46.0
0.46.1
0.46.2
0.46.3
0.47.0
0.47.1
0.47.2
0.47.3
0.48.0
0.48.1
0.49.0
0.50.0
0.50.1
0.50.2
0.51.0
0.52.0
0.52.1
0.53.0
0.53.1
0.54.0
0.54.1
0.54.2
0.55.0
0.55.1
0.56.0
0.56.1
0.56.2
0.57.0
0.57.1
0.57.2
0.57.3
0.57.4
0.57.5
0.58.0
0.58.1
0.58.2
0.59.0
0.59.1
0.60.0
0.60.1
0.60.2
0.61.0
0.62.0
0.62.1
0.62.10
0.62.11
0.62.2
0.62.3
0.62.4
0.62.5
0.62.6
0.62.7
0.62.8
0.62.9
0.63.0
0.63.1
0.63.10
0.63.2
0.63.3
0.63.4
0.63.5
0.63.6
0.63.7
0.63.8
0.63.9
0.64.0
0.64.1
0.64.2
0.65.0
0.65.1
0.65.10
0.65.11
0.65.12
0.65.13
0.65.14
0.65.2
0.65.3
0.65.4
0.65.5
0.65.6
0.65.7
0.65.8
0.65.9
0.66.0
0.66.1
0.66.2
0.66.3
0.66.4
0.67.0
0.68.0
0.68.1
0.69.0
0.69.1
0.70.0
0.70.1
0.70.2
0.70.3
0.70.4
0.70.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108384.json"