← back
CVE-2021-47952

python jsonpickle 2.0.0 Remote Code Execution via py/repr

CVSS 9.3 CRITICALEPSS 0.6%CWE-94
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Jsonpickle · python jsonpickle
public PoCs found — 1
cve_referencewww.exploit-db.com/exploits/49585unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/jsonpickle/jsonpicklehttps://jsonpickle.github.iohttps://www.exploit-db.com/exploits/49585https://www.vulncheck.com/advisories/python-jsonpickle-remote-code-execution-via-py-repr