CVE-2021-47952
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deseria
CVSS
9.8
Crítico
EPSS
0.7%
p49
KEV
—
Exploit Today
15
0-100
Publicado: 16 may 2026 · Última mod.: 15 jul 2026 · CWE-94 · CWE-502
0.7%EPSS · 30 días0.7%
2026-06-302026-07-17
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
- github.comhttps://github.com/jsonpickle/jsonpickle
- jsonpickle.github.iohttps://jsonpickle.github.io
- www.exploit-db.comhttps://www.exploit-db.com/exploits/49585
- www.vulncheck.comhttps://www.vulncheck.com/advisories/python-jsonpickle-remote-code-execution-via-py-repr
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2021-47952
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2478170
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47952.json
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-32489.8 CRÍ100.0%
KEV—80Langflow Missing Authentication Vulnerability3dCVE-2021-422379.8 CRÍ99.9%
KEV—80Sitecore XP Remote Command Execution Vulnerability8dCVE-2026-341978.8 ALT99.9%
KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3dCVE-2026-456598.8 ALT86.8%
KEV—76Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability15dCVE-2026-154107.2 ALT71.1%
KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability2dCVE-2026-586449.8 CRÍ70.7%
KEV—71Microsoft SharePoint Deserialization of Untrusted Data Vulnerability17h