GHSA-9h8h-264x: dataclasses-avroschema Code Injection via Unescaped Default Values (RCE)

Vulnerability Overview Vulnerability Name: Code injection via string or bytes field default values rendered into generated string literals Vulnerability ID: GHSA-9h8h-264x-jcg2 Severity: High (8.8 / 10) Description: The library generates Python model source files from Avro schemas. Default values for string, uuid, bytes, or fixed fields are written into generated string literals without escaping. If the default value contains double quotes, these quotes prematurely close the string when parsed as Python code, resulting in the execution of code when the generated module is imported. Affected Versions: Affected Versions: = 0.70.6 CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High Remediation Fix Commit: Fix Commit Link: https://github.com/marcossschroh/dataclasses-avroschema/commit/fix-escape-schema-values-rendered-into-generated-string-literals Fixed File: Fix Code: Explanation: escapes all characters that can terminate a Python string literal, including backslashes. The slice operation removes the enclosing quotes added by , ensuring the escaped content remains within the template's quotes. Workarounds Recommendations: Avoid generating models from untrusted schemas. If generation is necessary, inspect the generated source code before importing. References CVE-94: https://cve.mitre.org/data/definitions/94.html Similar vulnerability in another Python code generator: GHSA-9x4c-63pf-525f Proof of Concept (POC) Code Example of Generated Module Explanation: is a module-level assignment. Any code placed at that location, including imports and function calls, will execute upon import.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-9h8h-264x: dataclasses-avroschema Code Injection via Unescaped Default Values (RCE)

More from this source