CVE-2026-108379

Summary

The vulnerability allows arbitrary code execution during schema generation when processing fixed types with unescaped namespace values. An attacker can inject malicious code into generated configuration files by crafting quotes in namespace strings.

Exploitability

Exploitation requires a user to process a crafted Avro schema through the dataclasses-avroschema library, which is moderately difficult but possible if the application accepts untrusted schema inputs or generates code from user-provided schemas.

Blast radius

If exploited, attackers could execute arbitrary code on systems that generate Python classes from Avro schemas, potentially leading to full system compromise where such code generation is used.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the namespace validation issue in BaseGenerator.parse_fixed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.