Description
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
Published: 2026-05-16
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in jsonpickle 2.0.0 allows arbitrary Python code execution by deserializing malicious JSON payloads that contain py/repr objects. Attackers can craft JSON strings with py/repr directives that call eval during deserialization, enabling execution of arbitrary code. This flaw corresponds to CWE-94 (Code Injection) and CWE-502 (Deserialization of Untrusted Data) and can grant full control over the target process, allowing system compromise and data theft.

Affected Systems

The vulnerability affects the Jsonpickle library for Python, specifically version 2.0.0. Systems that use this exact version for deserializing JSON data are at risk unless updated to a patched release.

Risk and Exploitability

With a CVSS score of 9.3, the flaw is considered critical. The EPSS score is 0.004 (0.4%), indicating a low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending crafted JSON to any service that accepts jsonpickle deserialization, making the risk high in environments where untrusted data is processed.

Generated by OpenCVE AI on May 26, 2026 at 15:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade jsonpickle to the latest stable release that excludes the vulnerable 2.0.0 version.
  • If an upgrade is not immediately possible, disable or restrict the use of jsonpickle for processing untrusted input.
  • Implement strict validation to reject any payload containing the py/repr directive before deserialization.

Generated by OpenCVE AI on May 26, 2026 at 15:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 26 May 2026 13:45:00 +0000

Type Values Removed Values Added
Description python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code. python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.

Tue, 19 May 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-502
References
Metrics threat_severity

None

 threat_severity

Critical

Mon, 18 May 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 17 May 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Jsonpickle Project
Jsonpickle Project jsonpickle
Vendors & Products Jsonpickle Project
Jsonpickle Project jsonpickle

Sat, 16 May 2026 15:45:00 +0000

Type Values Removed Values Added
Description python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code.
Title python jsonpickle 2.0.0 Remote Code Execution via py/repr
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Jsonpickle Project Jsonpickle
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-26T11:51:43.547Z

Reserved: 2026-02-01T11:24:18.719Z

Link: CVE-2021-47952

cve-icon Vulnrichment

Updated: 2026-05-18T17:00:50.531Z

cve-icon NVD

Status : Deferred

Published: 2026-05-16T16:16:21.520

Modified: 2026-05-26T14:16:25.463

Link: CVE-2021-47952

cve-icon Redhat

Severity : Critical

Publid Date: 2026-05-16T15:26:06Z

Links: CVE-2021-47952 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-26T15:15:08Z

Weaknesses