The vulnerability lies in BaseGenerator.parse_fixed which interpolates the aliases value of a fixed-type field directly into a generated Avro schema module. If the aliases list contains a bare string, it is emitted as raw Python code and executed when the module is imported, allowing an attacker to run arbitrary code in the context of the importing process. This flaw is classified as CWE-94, an input that results in arbitrary code execution. The impact is the ability to execute malicious code on any system that imports a module produced from a malicious schema.

This issue affects the Python library dataclasses‑avroschema from vendor marcosschroh. Versions 0.38.0 through 0.70.5 are vulnerable. The newest release, 0.70.6, removes the unsafe behavior by rejecting non‑list aliases.

The CVSS score of 8.8 indicates a high severity. No EPSS score is available, and it is not listed in the CISA KEV catalog, but the flaw remains exploitable. The attack can be staged by an attacker supplying a crafted Avro schema that contains a malicious bare string alias; the resulting generated Python module will execute that string when imported. Current data suggest this requires the attacker to either control the generation process or have the target include the generated module in its code base. Thus, the exploit is feasible in scenarios where untrusted schemas are processed and the generated module is imported.