CVE-2026-108382

Summary

The vulnerability allows attackers to inject arbitrary Python code into generated enum classes when using dataclasses-avroschema with schema-controlled enum symbols that contain quotes. This can lead to remote code execution during module import.

Exploitability

Exploitation requires a maliciously crafted schema with enum symbols containing quotes, and the attacker must be able to influence schema generation or deployment of generated code, which is moderately difficult but possible in environments where schemas are dynamically generated from untrusted input.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary Python code on systems that import the generated modules, potentially leading to full system compromise if the affected service runs with elevated privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the enum symbol escaping vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.