{"id":"CVE-2026-108379","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-108379","generatedAt":"2026-10-28T03:25:59.080Z","title":"A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution.","description":"dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names.","published":"2026-10-13T18:17:17.000Z","lastModified":"2026-10-16T20:04:30.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-94"],"affected":[],"epss":{"score":0.00343,"percentile":0.27573,"date":"2026-10-26","history":[{"date":"2026-10-14","score":0.00343,"percentile":0.26108}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-13T18:17:17.000Z","detail":{"score":"8.8","severity":"HIGH","publishedAt":"2026-10-13T18:17:17.000Z"},"summary":"New CVE, high severity (CVSS 8.8)."}],"references":[{"url":"https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc","source":"security-advisories@github.com"},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6","source":"security-advisories@github.com"},{"url":"https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-h9q3-f96w-f88j","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-108379","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}