CVE-2026-108380

Summary

A Python library vulnerability allows arbitrary code execution during schema generation when user-provided documentation contains unescaped quotes. This enables attackers to inject malicious expressions into generated Pydantic models.

Exploitability

Moderately difficult to exploit as it requires crafting malicious documentation with quotes that terminate string literals, but can be achieved through controlled input in schema definitions.

Blast radius

High impact across applications using dataclasses-avroschema for generating Pydantic models, especially those accepting user input in schema documentation fields.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the quote escaping vulnerability in PydanticFieldRepresentation.add_field_properties.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.