CVE-2021-47952

python jsonpickle 2.0.0 Remote Code Execution via py/repr

Published May 16, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:jsonpickle_project:jsonpickle:2.0.0:*:*:*:*:*:*:*
Type Values Removed Values Added
Description python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code. python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Jsonpickle Project
Jsonpickle Project jsonpickle
Vendors & Products Jsonpickle Project
Jsonpickle Project jsonpickle
Type Values Removed Values Added
Description python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code.
Title python jsonpickle 2.0.0 Remote Code Execution via py/repr
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Jul 28, 2026, 1:47 AM
Reserved
Feb 1, 2026, 11:24 AM
Status
Deferred
Published
May 16, 2026, 4:16 PM
Modified
Jul 15, 2026, 2:17 AM
Severity
Critical
Public date
May 16, 2026, 3:26 PM