dataclasses-avroschema 0.68.0

Direct Vulnerabilities

Known vulnerabilities in the dataclasses-avroschema package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection in the `get_field_default` function. An attacker can execute arbitrary code by crafting schema-controlled field defaults that inject statements into generated Python modules, which are then executed upon import. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection through the `render_metaclass` process. An attacker can execute arbitrary code by crafting a malicious Avro record name that is inserted into the `Meta.schema_name` field of generated Python source, which is then executed when the generated module is imported. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the `parse_enum` or `render_symbols` process. An attacker can execute arbitrary code or modify the namespace by injecting malicious statements into generated enum member names when generator classes are used directly. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the `PydanticFieldRepresentation.add_field_properties` function. An attacker can execute arbitrary Python code by crafting a malicious schema field documentation value that is injected and evaluated during generated class definition. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the `EnumRepresentation.render_symbols` process. An attacker can execute arbitrary Python code by injecting malicious enum symbol values, which are incorporated into generated enum class bodies and executed upon module import. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection in the `parse_fixed` process. An attacker can execute arbitrary code by supplying a crafted schema with a fixed-type alias as a bare string, which is interpolated directly into a generated annotation and evaluated upon module import. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the `get_field_default` function. An attacker can execute arbitrary code by injecting malicious statements into generated modules through specially crafted enum field defaults. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the `parse_fixed` function. An attacker can execute arbitrary code by supplying a crafted namespace value containing malicious input, which is inserted into generated annotation expressions and evaluated during class definition. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the `ClassRepresentation.render_docstring` process. An attacker can execute arbitrary Python code during module import by crafting a schema record's doc value to include a triple-quote sequence that closes the generated docstring and injects statements into the class body, or by using a trailing backslash to escape the closing delimiter. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the `pydantic-class` metadata field in generated annotations. An attacker can execute arbitrary code by supplying a crafted value that is evaluated when the generated module is imported. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)
C Arbitrary Code Injection dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the `get_field_default` process. An attacker can execute arbitrary code by supplying a crafted record name that is inserted into the callable position of a generated default_factory lambda. How to fix Arbitrary Code Injection? Upgrade `dataclasses-avroschema` to version 0.70.6 or higher.	[,0.70.6)

Vulnerability

Vulnerable Version

Arbitrary Code Injection