CVE-2026-108375

Katalog CVE

CVSS 8.8 · High

Kerentanan Improper Control of Generation of Code ('Code Injection'). Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module, which execute when the module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals.

Rincian

Terbit di NVD

13 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Received

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/marcosschroh/dataclasses-avroschema/commit/01e6d5e15ab0ff69faac39a340d21b85da1e852f
• https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6
• https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-9h8h-264x-jcg2