6 matches found
Arbitrary Code Injection
Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection through the rendermetaclass process. An attacker can execute arbitrary code by...
CVE-2026-108377 dataclasses-avroschema allows code injection through generated Meta.schema_name
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.rendermetaclass inserts a schema-controlled Avro record name into the quoted Meta.schemana...
CVE-2026-108377
The dataclasses-avroschema library (versions 0.62.3 through 0.70.5 ) is vulnerable to code injection due to improper handling of schema-controlled record names. Specifically, the ClassRepresentation.render_metaclass function inserts these names into the Meta.schema_name field of generated Python ...
EUVD-2026-98962
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.rendermetaclass inserts a schema-controlled Avro record name into the quoted Meta.schemana...
CVE-2026-108377 dataclasses-avroschema allows code injection through generated Meta.schema_name
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.rendermetaclass inserts a schema-controlled Avro record name into the quoted Meta.schemana...
CVE-2026-108377 dataclasses-avroschema allows code injection through generated Meta.schema_name
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.rendermetaclass inserts a schema-controlled Avro record name into the quoted Meta.schemana...