CVE-2026-108383

Summary

The vulnerability allows attackers to inject malicious code into generated Python modules by manipulating enum field defaults in Avro schema generation. This occurs when case conversion doesn't validate enum references as proper identifiers, enabling injection of arbitrary statements that can modify namespaces or prevent module loading.

Exploitability

Exploitation requires a vulnerable version (0.38.0-0.70.5) and control over dataclass field definitions that use enum defaults, with minimal preconditions for successful injection.

Blast radius

The vulnerability could affect any application using dataclasses-avroschema to generate Python code from Avro schemas, potentially leading to remote code execution or module loading failures in applications that import the generated code.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the enum default validation issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.