CVE-2026-108376

Summary

A Python library vulnerability allows attackers to inject arbitrary Python code through crafted Avro record names in default factory lambdas, leading to remote code execution when models are instantiated.

Exploitability

Exploitation requires a maliciously crafted Avro schema with a record name that becomes executable Python code in a lambda expression, but is relatively straightforward when applications use this library to process untrusted Avro data.

Blast radius

The vulnerability could affect any application using dataclasses-avroschema to process untrusted Avro schemas, potentially leading to widespread remote code execution across services that consume such data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the Avro name validation issue in FieldRepresentation.get_field_default.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.