dataclasses-avroschema 0.38.0-0.70.5 builds Python enums from Avro schema symbols without validating them as identifiers. An attacker who can supply a crafted enum symbol can inject newlines or punctuation that becomes executable statements within the generated enum class body. This can alter the namespace or cause the generated module to fail to load, effectively enabling the attacker to run arbitrary code while the module is imported or compiled. The vulnerability is a classic code‑injection flaw (CWE‑94).

The Python library dataclasses-avroschema, version 0.38.0 through 0.70.5, is impacted. Vendors and users of this library that generate Python code from Avro schemas need to be aware of the affected range.

The CVSS score of 8.8 indicates a high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can supply or influence the Avro schema used by BaseGenerator.parse_enum or EnumRepresentation.render_symbols. If the code generation is performed in a trusted environment, an attacker can trigger code execution at import time or cause a module load failure. The attack surface is local to the environment where the library runs; remote exploitation would need additional privileges to supply schema data. Given the high CVSS, the risk to systems that use this library without updated validation is significant.