Summary
dataclasses-avroschema can generate Python models from Avro schemas, but certain documentation values are inserted into generated Pydantic field definitions without escaping. If an attacker can influence a schema field's documentation and trigger model generation, injected expressions may execute as Python code during class definition.
dataclasses-avroschema can generate Python models from Avro schemas, but certain documentation values are inserted into generated Pydantic field definitions without escaping. If an attacker can influence a schema field's documentation and trigger model generation, injected expressions may execute as Python code during class definition.
Affected context
The vulnerability occurs in environments that use dataclasses-avroschema to generate Pydantic or AvroDantic models from Avro schemas. It becomes risky when schema documentation values are attacker-controlled or insufficiently trusted and are rendered directly into generated Python source without appropriate escaping.
The vulnerability occurs in environments that use dataclasses-avroschema to generate Pydantic or AvroDantic models from Avro schemas. It becomes risky when schema documentation values are attacker-controlled or insufficiently trusted and are rendered directly into generated Python source without appropriate escaping.
Exploit preconditions
- Attack surface: Avro schema processing and generated Pydantic or AvroDantic model creation
- Required access: Ability to supply or modify an Avro schema field documentation value
- Trigger point: Generation and definition of the resulting Python model class
- Why exploitation is possible: The documentation value is inserted into a generated string literal without escaping, allowing crafted content to alter the generated expression
- Attack surface: Avro schema processing and generated Pydantic or AvroDantic model creation
- Required access: Ability to supply or modify an Avro schema field documentation value
- Trigger point: Generation and definition of the resulting Python model class
- Why exploitation is possible: The documentation value is inserted into a generated string literal without escaping, allowing crafted content to alter the generated expression
Why this happens
The underlying bug is an output-encoding failure in a source-code generation path. A schema field's doc value is placed inside a generated pydantic.Field description string without escaping embedded quotes or other syntax-significant characters. This allows data intended to remain a string literal to change the structure of generated Python code, matching CWE-94: Improper Control of Generation of Code ('Code Injection').
The underlying bug is an output-encoding failure in a source-code generation path. A schema field's doc value is placed inside a generated pydantic.Field description string without escaping embedded quotes or other syntax-significant characters. This allows data intended to remain a string literal to change the structure of generated Python code, matching CWE-94: Improper Control of Generation of Code ('Code Injection').
Potential impact
- An attacker may execute arbitrary Python expressions in the model-generation process.
- Generated application code may be compromised before normal validation occurs.
- Credentials, environment variables, or local files could be exposed.
- The affected process could be used to modify data or access connected services.
- A compromised build or generation pipeline could enable broader supply-chain impact.
- An attacker may execute arbitrary Python expressions in the model-generation process.
- Generated application code may be compromised before normal validation occurs.
- Credentials, environment variables, or local files could be exposed.
- The affected process could be used to modify data or access connected services.
- A compromised build or generation pipeline could enable broader supply-chain impact.
General mitigation guidance
Mitigation generally focuses on treating schema metadata as untrusted data throughout code-generation workflows.
Common defensive patterns include:
- Escaping documentation and metadata values according to the target Python syntax before rendering source code.
- Preferably constructing model objects through safe APIs or structured representations rather than concatenating source-code fragments.
- Applying strict schema validation and limiting accepted metadata formats.
- Separating trusted generation inputs from user-controlled schemas and reducing input trust wherever possible.
- Running generation processes with least-privilege permissions, restricted filesystem access, and limited network reachability.
- Reviewing generated source before execution and avoiding automatic execution of unverified generated code.
Mitigation generally focuses on treating schema metadata as untrusted data throughout code-generation workflows.
Common defensive patterns include:
- Escaping documentation and metadata values according to the target Python syntax before rendering source code.
- Preferably constructing model objects through safe APIs or structured representations rather than concatenating source-code fragments.
- Applying strict schema validation and limiting accepted metadata formats.
- Separating trusted generation inputs from user-controlled schemas and reducing input trust wherever possible.
- Running generation processes with least-privilege permissions, restricted filesystem access, and limited network reachability.
- Reviewing generated source before execution and avoiding automatic execution of unverified generated code.
How teams detect issues like this
Detection can include static analysis for string interpolation or concatenation into Python source, especially where schema fields are inserted into quoted literals. Code review should examine escaping boundaries, generated Field arguments, and any path that evaluates or imports generated classes. Policy checks can require structured code-generation APIs, schema provenance validation, and tests containing quotes and syntax-significant metadata. Automated review tools may help identify unsanitized data flowing into executable source-generation sinks.
Detection can include static analysis for string interpolation or concatenation into Python source, especially where schema fields are inserted into quoted literals. Code review should examine escaping boundaries, generated Field arguments, and any path that evaluates or imports generated classes. Policy checks can require structured code-generation APIs, schema provenance validation, and tests containing quotes and syntax-significant metadata. Automated review tools may help identify unsanitized data flowing into executable source-generation sinks.
