CVE-2026-108378

Summary

The vulnerability allows attackers to inject arbitrary Python code into generated classes during module import by exploiting unsafe docstring rendering in dataclasses-avroschema. This can lead to remote code execution when the vulnerable module is loaded.

Exploitability

Exploitation requires a malicious schema with crafted triple-quote sequences and trailing backslashes, but is relatively straightforward once an attacker can influence schema generation or deployment.

Blast radius

The vulnerability affects any application using dataclasses-avroschema to generate Python code from Avro schemas, potentially impacting many backend services and microservices that rely on schema generation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the unsafe docstring rendering issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.