CVE-2026-108384

Summary

The vulnerability allows arbitrary code execution during schema parsing when processing fixed type aliases in dataclasses-avroschema. An attacker can craft a malicious schema that executes arbitrary Python code upon import of the generated module.

Exploitability

Exploitation is moderately difficult as it requires an attacker to control a schema definition that gets processed by the vulnerable library, typically involving a user-supplied or untrusted schema that gets parsed and generates executable Python code.

Blast radius

The impact could be significant in environments where schemas are imported from untrusted sources, potentially leading to full system compromise through code execution in the context of the importing process.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.70.6 or later to fix the vulnerability in BaseGenerator.parse_fixed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.