CVE-2026-108382 dataclasses-avroschema allows code injection through generated enum-symbol string literals

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.rendersymbols concatenates each schema-controlled enum symbol between double quotes in a...

CVE-2026-108382 dataclasses-avroschema allows code injection through generated enum-symbol string literals

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.rendersymbols concatenates each schema-controlled enum symbol between double quotes in a...

CVE-2026-108382 dataclasses-avroschema allows code injection through generated enum-symbol string literals

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.rendersymbols concatenates each schema-controlled enum symbol between double quotes in a...

CVE-2026-108382

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.rendersymbols concatenates each schema-controlled enum symbol between double quotes in a...

CVE-2026-108382

The dataclasses-avroschema library (versions 0.38.0 through 0.70.5 ) is vulnerable to code injection due to how it handles enum symbols. The EnumRepresentation.render_symbols function concatenates schema-controlled enum symbols between double quotes in generated Python code. If a quote is include...

CVE-2026-108381 dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a...

CVE-2026-108380

The dataclasses-avroschema library (versions 0.65.9 through 0.70.5 ) is vulnerable to code injection via the PydanticFieldRepresentation.add_field_properties function. The root cause is the failure to escape a schema field's doc value when inserting it into a generated pydantic.Field description ...

CVE-2026-108380

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.addfieldproperties inserts a schema field's doc value between the quotes of a...

CVE-2026-108380 dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.addfieldproperties inserts a schema field's doc value between the quotes of a...

CVE-2026-108379 dataclasses-avroschema fixed namespaces allow code injection in generated annotations

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parsefixed inserts a fixed type's namespace value between quotes inside a generated types.confix...

CVE-2026-108379

The dataclasses-avroschema library (versions 0.38.0 through 0.70.5 ) contains a code injection vulnerability. The BaseGenerator.parse_fixed function fails to escape or validate a fixed type's namespace value when generating Python code from Avro schemas. An attacker can provide a crafted quote to...

EUVD-2026-98964

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

CVE-2026-108378

The dataclasses-avroschema library (versions 0.40.0 through 0.70.5 ) is vulnerable to code injection via the ClassRepresentation.render_docstring function. The root cause is the failure to escape quotes, backslashes, or unsafe control characters when copying a schema record's doc value into a gen...

CVE-2026-108378 dataclasses-avroschema record documentation can terminate generated class docstrings

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.renderdocstring copies a schema record's doc value into a generated triple-double-quoted...

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform BTP that use the SDK, SAP's official Python clie...

EUVD-2026-98962

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.rendermetaclass inserts a schema-controlled Avro record name into the quoted Meta.schemana...

CVE-2026-108377

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.rendermetaclass inserts a schema-controlled Avro record name into the quoted Meta.schemana...

CVE-2026-108377 dataclasses-avroschema allows code injection through generated Meta.schema_name

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.rendermetaclass inserts a schema-controlled Avro record name into the quoted Meta.schemana...

CVE-2026-108376

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.getfielddefault inserts a schema-controlled referenced record name into the callable...

CVE-2026-108375 dataclasses-avroschema allows code injection through generated field-default literals

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.getfielddefault inserts schema-controlled string, UUID, bytes, and fixed field defaults in...