CVE-2026-108375

Summary

The vulnerability allows attackers to inject arbitrary Python code into generated modules by manipulating default values in dataclasses-avroschema, potentially leading to remote code execution when the compromised modules are imported.

Exploitability

Exploitation requires crafting malicious default values that terminate string literals and inject executable statements, with no additional preconditions beyond having the vulnerable version installed.

Blast radius

The impact could be significant across applications using dataclasses-avroschema for schema generation, especially those importing generated modules from untrusted sources.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the string escaping vulnerability in FieldRepresentation.get_field_default.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.