The library generates Python source from Avro schemas, inserting default values into quoted literals without escaping them. A crafted default can close the literal early and inject arbitrary code, which runs when the module is imported. This flaw is a code‑injection vulnerability (CWE‑94) that can allow an attacker to execute arbitrary Python code within any process that imports the generated module.

Python projects using the open‑source library dataclasses‑avroschema between versions 0.38.0 and 0.70.5, inclusive. The issue is fixed in 0.70.6 and later. Any environment that generates and imports schemas with these affected library versions is at risk.

The CVSS score of 8.8 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the flaw remains exploitable where a malicious schema is supplied. An attacker can embed malicious content in a default value; when the library processes the schema and a consuming application imports the generated module, the injected code executes with the application's privileges. The attack requires the malicious schema to be ingested but does not need a network exploit. The impact is full code execution, potentially compromising confidentiality, integrity, and availability of the affected system.