dataclasses-avroschema generates Avro schemas and Python code from Avro schemas. Between versions 0.38.0 and 0.70.5 the EnumRepresentation.render_symbols function concatenated enum symbols between double quotes in a generated enum assignment. When a quote appears in an enum symbol, it can terminate the string literal and inject arbitrary Python code into the enum class body. When the generated module is imported, the injected code is executed. This code injection flaw is a static code injection vulnerability that allows an attacker who controls the enum symbols to run arbitrary Python code in the context of the importing process, corresponding to CWE-94.

The vulnerable product is dataclasses-avroschema by marcosschroh. Versions from 0.38.0 through 0.70.5 are affected. The issue was fixed in version 0.70.6.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the import of user‑generated modules that contain attacker‑controlled enum symbols. An attacker requires the ability to supply or influence the schema used to generate the module, then cause the vulnerable application to import that module. Successful exploitation results in code execution with the privileges of the importing process.