EUVD-2026-114513

In Trail of Bits fickling through 0.1.12, the processimport method in fickle.py adds an imported name to the likelysafeimports set whenever the source module is present in sys.stdlibmodulenames and the name is absent from the UNSAFEIMPORTS denylist, without inspecting what the name resolves to or...

CVE-2026-16760

In Trail of Bits fickling through 0.1.12, the processimport method in fickle.py adds an imported name to the likelysafeimports set whenever the source module is present in sys.stdlibmodulenames and the name is absent from the UNSAFEIMPORTS denylist, without inspecting what the name resolves to or...

CVE-2026-16760

The Trail of Bits fickling tool (through version 0.1.12 ) contains a security bypass in the check_safety() function. The _process_import() method in fickle.py incorrectly grants module-level trust to any name from sys.stdlib_module_names not in the UNSAFE_IMPORTS denylist. Because the OvertlyBadE...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108381 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108381 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693576...

Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the pydantic-class metadata field in generated annotations. An attacker can...

Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the ClassRepresentation.renderdocstring process. An attacker can execute...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108378 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108378 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693577...

Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the parsefixed function. An attacker can execute arbitrary code by supplying a...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108379 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108379 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693578...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108383 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108383 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693579...

Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the getfielddefault function. An attacker can execute arbitrary code by injecti...

Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection in the parsefixed process. An attacker can execute arbitrary code by supplying a...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108384 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108384 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693580...

Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the EnumRepresentation.rendersymbols process. An attacker can execute arbitrary...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108382 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108382 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693581...

Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the PydanticFieldRepresentation.addfieldproperties function. An attacker can...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108380 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108380 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693582...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108385 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108385 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693583...

Arbitrary Code Injection

Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the parseenum or rendersymbols process. An attacker can execute arbitrary code ...

confluent-kafka-config (1.1.4), dc-avro (>=0.1.0, <=0.9.1) +4 more potentially affected by CVE-2026-108377 via dataclasses-avroschema (>=0.25.3, <=0.65.7)

dataclasses-avroschema PYPI version =0.25.3, =0.1.0, =0.0.2, =0.1.0, =0.9.2, =0.9.10 Source cves: CVE-2026-108377 Source advisory: SNYK:PYTHON-DATACLASSESAVROSCHEMA-21693584...