CVE-2026-108381

Summary

The vulnerability allows remote code execution through unsafe evaluation of Pydantic class annotations in generated Avro schemas. An attacker can inject malicious Python code that executes during module import when using dataclasses-avroschema with Pydantic models.

Exploitability

Exploitation requires a crafted schema with malicious annotation values that get evaluated during import, making it moderately difficult to exploit without user interaction or specific deployment conditions.

Blast radius

The vulnerability affects any application using dataclasses-avroschema with Pydantic models in versions 0.44.0 through 0.70.5, potentially leading to full system compromise when generated code is imported.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the unsafe annotation evaluation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.