A flaw in dataclasses-avroschema allows a crafted Avro record name to be injected as a Python expression in the lambda used for a field's default_factory. When the generated model creates an instance, this expression is evaluated, giving the attacker the ability to execute arbitrary code. The weakness is an input validation failure (CWE-94).

The issue impacts the Python library marcosschroh:dataclasses-avroschema versions 0.47.3 through 0.70.5. Systems that use these releases to generate dataclasses, Pydantic models, or Faust records from Avro schemas are potentially affected.

The CVSS score of 8.8 indicates a high severity. While no EPSS score is available, the lack of a KEV listing does not diminish the potential for exploitation. The vulnerability can be triggered when an attacker supplies a malicious record name during schema creation, making it most relevant for applications that import or process external Avro schemas without validating record names. Given the high severity and the ability to execute code on model instantiation, the risk is substantial under the described conditions.