CVE-2026-108380

HighCVSS 8.8/10Last modified Oct 16, 2026

Description

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1083818.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083828.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083838.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083848.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083858.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083883.5Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the uCVE-2026-108395.1Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to aCVE-2026-1083909.9Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value(CVE-2026-1083957.5The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12CVE-2026-1083967.0Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileCVE-2026-1083988.8Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.CVE-2026-1083997.2Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.