Description
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Jsonpickle python jsonpickle
2.0.0affected
References
- https://www.exploit-db.com/exploits/49585 ↗
- https://jsonpickle.github.io ↗
- https://github.com/jsonpickle/jsonpickle ↗
- https://www.vulncheck.com/advisories/python-jsonpickle-remote-code-execution-via-py-repr ↗
- https://access.redhat.com/security/cve/CVE-2021-47952 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2478170 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47952.json ↗