CVE-2026-108385Proof of concept (PoC) published · CISA
dataclasses-avroschema enum symbols can inject statements through generated member names
CVSS score
8.8
EPSS probability
%0.4
Risk score
0.0
Published
2 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.8
CVE-2026-108375
dataclasses-avroschema allows code injection through generated field-default literals
M
Patch status unknownEPSS %0
8.8
CVE-2026-108380
dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions
M
Patch status unknownEPSS %0
8.8
CVE-2026-108377
dataclasses-avroschema allows code injection through generated Meta.schema_name
M
Patch status unknownEPSS %0
8.8
CVE-2026-108376
dataclasses-avroschema allows code injection through record names in generated default factories
M
Patch status unknownEPSS %0
8.8
CVE-2026-108382
dataclasses-avroschema allows code injection through generated enum-symbol string literals
M
Patch status unknownEPSS %0
8.8
CVE-2026-108384
dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string
M
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-108385"