Description (CNA)
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Jsonpickle / python jsonpickle | affected 2.0.0 |
CWE
CWE-94
References
- https://www.exploit-db.com/exploits/49585
- https://jsonpickle.github.io
- https://github.com/jsonpickle/jsonpickle
- https://www.vulncheck.com/advisories/python-jsonpickle-remote-code-execution-via-py-repr
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in python-jsonpickle. A remote attacker can exploit this vulnerability by crafting and sending malicious JSON payloads. When these payloads, which contain specially crafted py/repr objects, are deserialized, they can trigger the execution of arbitrary Python commands and system commands. This can lead to arbitrary code execution on the affected system.