Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108385— dataclasses-avroschema enum symbols can inject statements through generated member names

Quick assessment

Affected
marcosschroh dataclasses-avroschema
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述： dataclasses-avroschema 是一款用于从 Python 的 dataclass、Pydantic 模型和 Faust Record 生成 Avro 模式，以及从 Avro 模式生成 Python 代码的库。在版本 0.38.0 至 0.70.5 中， 和 方法在生成枚举成员时，会将每个由模式控制的枚举符号（enum symbol）经大小写转换后直接用作生成的枚举类的成员名称，但并未验证其是否为合法的标识符。 当直接调用生成器类时，攻击者可通过在枚举符号中嵌入换行符或标点符号，向生成的枚

CVSS 8.8 · High

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

VendorProduct Version RangeStatus
marcosschroh dataclasses-avroschema >= 0.38.0, < 0.70.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108385

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
dataclasses-avroschema enum symbols can inject statements through generated member names
Source: CVE Program / CVE List V5
Vulnerability Description
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
marcosschroh dataclasses-avroschema >= 0.38.0, < 0.70.6 -

II. Public POCs for CVE-2026-108385

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108385

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-108385 (1)

Vendor Pages for CVE-2026-108385 (1)

Same Patch Batch · marcosschroh · 2026-10-13 · 11 CVEs total

CVE-2026-108376 8.8 HIGH dataclasses-avroschema allows code injection through record names in generated default fac
CVE-2026-108375 8.8 HIGH dataclasses-avroschema allows code injection through generated field-default literals
CVE-2026-108377 8.8 HIGH dataclasses-avroschema allows code injection through generated Meta.schema_name
CVE-2026-108380 8.8 HIGH dataclasses-avroschema field documentation allows code injection in generated Pydantic des
CVE-2026-108378 8.8 HIGH dataclasses-avroschema record documentation can terminate generated class docstrings
CVE-2026-108381 8.8 HIGH dataclasses-avroschema pydantic-class metadata allows code injection in generated annotati
CVE-2026-108379 8.8 HIGH dataclasses-avroschema fixed namespaces allow code injection in generated annotations
CVE-2026-108382 8.8 HIGH dataclasses-avroschema allows code injection through generated enum-symbol string literals
CVE-2026-108383 8.8 HIGH dataclasses-avroschema enum field defaults can inject statements into generated modules
CVE-2026-108384 8.8 HIGH dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare

IV. Related Vulnerabilities

Same product: dataclasses-avroschema
Same vendor: marcosschroh
Same weakness: CWE-94

V. Comments for CVE-2026-108385

No comments yet

Leave a comment