Is CVE-2026-108380 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108380 being exploited in the wild.

How severe is CVE-2026-108380?

High severity, with a CVSS score of 8.8, published 13 October 2026.

Which products and versions are affected?

Dataclasses-Avroschema 0.65.9 through 0.70.5.

Is there a fix for CVE-2026-108380?

Yes: fixed in 0.70.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108380 attacked?

It is attacked over the network.

Am I affected by CVE-2026-108380?

Check whether you run Dataclasses-Avroschema at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108380: dataclasses-avroschema code injection in field documentation

CVE-2026-108380 · Severity: high · CVSS 8.8 · Published 2026-10-13

dataclasses-avroschema is a Python library that generates data model classes from Avro schemas. When generating Pydantic models from untrusted schemas, the library failed to escape field documentation strings, allowing an attacker to break out of the string literal and inject arbitrary Python code that executes when the generated module is imported. This could give an attacker complete control over systems that generate models from attacker-controlled schemas.

Technologies: Dataclasses-Avroschema. Vendors: Dataclasses-Avroschema.

Quick answers

Is CVE-2026-108380 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108380 being exploited in the wild.
How severe is CVE-2026-108380?: High severity, with a CVSS score of 8.8, published 13 October 2026.
Which products and versions are affected?: Dataclasses-Avroschema 0.65.9 through 0.70.5.
Is there a fix for CVE-2026-108380?: Yes: fixed in 0.70.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108380 attacked?: It is attacked over the network.
Am I affected by CVE-2026-108380?: Check whether you run Dataclasses-Avroschema at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.70.6

Technical details

PydanticFieldRepresentation.add_field_properties in versions 0.65.9–0.70.5 inserts Avro schema field doc values directly into pydantic.Field description arguments without escaping, allowing a quote character in the doc value to terminate the string literal and inject code. The vulnerability affects model generation from Pydantic and AvroDantic schemas; exploitation requires the victim to generate models from an attacker-controlled or compromised schema. Version 0.70.6 escapes documentation values with json.dumps before rendering.

Affected products

dataclasses-avroschema dataclasses-avroschema 0.65.9 through 0.70.5

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.