The vulnerability lies in the dataclasses-avroschema library’s method for rendering enum defaults within generated Python code. The code generation routine accepts default values for enum fields without validating them as identifiers. An attacker can embed newlines, operators, or punctuation in the default, causing the rendered code to contain arbitrary Python statements. This allows injection of code that modifies the module’s namespace or prevents loading, effectively providing remote code execution during import.

Vulnerable releases of the library run from version 0.38.0 up to and including 0.70.5, all maintained by marcosschroh. The bug was addressed in release 0.70.6. Systems that depend on these older versions and generate Python modules from Avro schemas are at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. With no EPSS score available, the likelihood of exploitation in the wild is uncertain but the high severity suggests careful monitoring. Because the bug manifests when the library processes untrusted schema data, an attacker who can supply or influence Avro schemas can inject code. The vulnerability is not listed in the CISA KEV catalog, implying no widespread existing exploits are known. Still, the combination of high impact and potential for exploitation warrants immediate patching unless a temporary mitigation is in place.