Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the ClassRepresentation.renderdocstring process. An attacker can execute...

CVE-2026-108378

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

EUVD-2026-98964

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

CVE-2026-108378

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

CVE-2026-108378 dataclasses-avroschema record documentation can terminate generated class docstrings

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

CVE-2026-108378 dataclasses-avroschema record documentation can terminate generated class docstrings

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

CVE-2026-108378 dataclasses-avroschema record documentation can terminate generated class docstrings

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

CVE-2026-108378

The dataclasses-avroschema library (versions 0.40.0 through 0.70.5 ) is vulnerable to code injection via the ClassRepresentation.render_docstring function. The root cause is the failure to escape quotes, backslashes, or unsafe control characters when copying a schema record's doc value into a gen...

CVE-2026-108378: Improper Control of Generation of Code

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...