python jsonpickle 2.0.0 Remote Code Execution via py/repr
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Jsonpickle | python jsonpickle | affected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Jsonpickle Project | Jsonpickle |
|
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.696% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:jsonpickle_project:jsonpickle:2.0.0:*:*:*:*:*:*:* |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code. | python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code. |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-502 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Jsonpickle Project
Jsonpickle Project jsonpickle |
|
| Vendors & Products |
Jsonpickle Project
Jsonpickle Project jsonpickle |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code. | |
| Title | python jsonpickle 2.0.0 Remote Code Execution via py/repr | |
| Weaknesses | CWE-94 | |
| References |
| |
| Metrics |
cvssV3_1
|