---
id: CVE-2026-108380
title: >-
  dataclasses-avroschema generates Avro schemas from Python dataclasses,
  Pydantic models, and Faust Records and generates Python code from Avro schemas
summary: >-
  dataclasses-avroschema generates Avro schemas from Python dataclasses,
  Pydantic models, and Faust Records and generates Python code from Avro
  schemas. From version 0.65.9 through 0.70.5,
  PydanticFieldRepresentation.add_field_properties i…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:18:04.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108380'
references:
  - url: >-
      https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc
    label: security-advisories@github.com
  - url: 'https://github.com/marcosschroh/dataclasses-avroschema/pull/843'
    label: security-advisories@github.com
  - url: 'https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-g7p7-mgvm-jw7p
    label: security-advisories@github.com
  - url: >-
      https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-g7p7-mgvm-jw7p
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
ingestedAt: '2026-10-13T18:41:42.739Z'
---

## Overview

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.