CVE-2021-47952
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
The jsonpickle library version 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
Risk Assessment
The risk for the organization is the potential for a remote attacker to take control of the system, which could lead to data theft, malware installation, or complete compromise of system integrity.
Recommendation
It is recommended to immediately update the jsonpickle library to version 2.0.1 or later, which fixes this vulnerability. Also, avoid deserializing untrusted JSON data.
Original NVD description (English source)
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.