Summary
dataclasses-avroschema may place an insufficiently restricted schema value into a generated Pydantic field annotation. When the generated module is imported, the annotation can be evaluated as Python code, allowing crafted input to execute arbitrary code.
dataclasses-avroschema may place an insufficiently restricted schema value into a generated Pydantic field annotation. When the generated module is imported, the annotation can be evaluated as Python code, allowing crafted input to execute arbitrary code.
Affected context
The vulnerability affects the Pydantic and AvroDantic model generators in dataclasses-avroschema versions 0.44.0 through 0.70.5 when they generate Python modules from schemas containing attacker-influenced field metadata. Risk arises when the generated module is subsequently imported in a Python environment with sufficient privileges.
The vulnerability affects the Pydantic and AvroDantic model generators in dataclasses-avroschema versions 0.44.0 through 0.70.5 when they generate Python modules from schemas containing attacker-influenced field metadata. Risk arises when the generated module is subsequently imported in a Python environment with sufficient privileges.
Exploit preconditions
- Attack surface: Schema-to-Python model generation and generated-module import - Required access: Ability to supply or influence a schema field's pydantic-class value - Trigger point: Evaluation of the generated field annotation during module import - Why exploitation is possible: The value is inserted into executable annotation
syntax without restricting it to a safe identifier or approved expression form
- Attack surface: Schema-to-Python model generation and generated-module import - Required access: Ability to supply or influence a schema field's pydantic-class value - Trigger point: Evaluation of the generated field annotation during module import - Why exploitation is possible: The value is inserted into executable annotation
syntax without restricting it to a safe identifier or approved expression form
Why this happens
The model generators embed a schema-provided value into a Python annotation without adequately constraining its syntax. Because Python annotations in the generated module are evaluated during import, attacker-controlled expression content can be interpreted and executed rather than treated as inert data. This is a code injection condition mapped to CWE-94, Improper Control of Generation of Code.
The model generators embed a schema-provided value into a Python annotation without adequately constraining its syntax. Because Python annotations in the generated module are evaluated during import, attacker-controlled expression content can be interpreted and executed rather than treated as inert data. This is a code injection condition mapped to CWE-94, Improper Control of Generation of Code.
Potential impact
- An attacker could execute arbitrary Python code in the importing process
- The application environment may be compromised
- Sensitive files, credentials, or configuration data could be accessed
- Generated artifacts or downstream schemas could be modified
- The vulnerable process could be used for lateral movement or data tampering
- An attacker could execute arbitrary Python code in the importing process
- The application environment may be compromised
- Sensitive files, credentials, or configuration data could be accessed
- Generated artifacts or downstream schemas could be modified
- The vulnerable process could be used for lateral movement or data tampering
General mitigation guidance
Mitigation generally focuses on treating schema metadata as data rather than executable source. Generated expressions should be built from strict allowlisted grammar, such as a bare name or a call to a bare name with literal arguments, while rejecting attribute access, operators, statements, and other dynamic constructs. Input trust should be reduced through schema validation, constrained model-generation interfaces, and separation of generation from privileged runtime environments. Generated modules should be imported with least-privilege permissions and with access to secrets and sensitive resources minimized.
Mitigation generally focuses on treating schema metadata as data rather than executable source. Generated expressions should be built from strict allowlisted grammar, such as a bare name or a call to a bare name with literal arguments, while rejecting attribute access, operators, statements, and other dynamic constructs. Input trust should be reduced through schema validation, constrained model-generation interfaces, and separation of generation from privileged runtime environments. Generated modules should be imported with least-privilege permissions and with access to secrets and sensitive resources minimized.
How teams detect issues like this
Detection can include static-analysis rules for interpolating schema values into Python source, annotations, eval-like constructs, or dynamically imported modules. Code review should flag generated-code templates that accept unvalidated identifiers or expressions and should verify that generated syntax follows an allowlisted grammar. CI policies can require schema validation, generated-code inspection, and tests using hostile metadata values. Automated security review tools may help identify unsafe code-generation patterns.
Detection can include static-analysis rules for interpolating schema values into Python source, annotations, eval-like constructs, or dynamically imported modules. Code review should flag generated-code templates that accept unvalidated identifiers or expressions and should verify that generated syntax follows an allowlisted grammar. CI policies can require schema validation, generated-code inspection, and tests using hostile metadata values. Automated security review tools may help identify unsafe code-generation patterns.
