BaseGenerator.parse_fixed in dataclasses-avroschema inserts a fixed type's namespace value directly into a generated types.confixed annotation without escaping. A crafted quote breaks out of the string and alters the surrounding Python annotation expression, which Python evaluates when the class is defined. The resulting effect is arbitrary code execution during import or runtime of the generated class. This is a classic code injection flaw (CWE‑94).

The library marcosschroh dataclasses-avroschema is affected for all releases from version 0.38.0 through 0.70.5 inclusive. In these versions the BaseGenerator.parse_fixed function processes namespace strings unsafely. The issue is resolved in 0.70.6, which enforces that namespaces consist of a dot‑separated sequence of valid Avro names.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to supply a crafted Avro schema file with a malicious namespace string; when the library generates Python code from that schema, the unsafe injection is executed. This can happen in any environment where the library processes external schemas, making the risk significant for systems that rely on dynamic schema generation.