CVE-2021-47952
python jsonpickle 2.0.0 Remote Code Execution via py/repr
CVSS Score
9.8
EPSS Score
0.6%
EPSS Percentile
46th
python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.
| CWE | CWE-94 |
| Vendor | jsonpickle |
| Product | python jsonpickle |
| Published | May 16, 2026 |
| Last Updated | Jun 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for jsonpickle python jsonpickle
Be the first to know when new critical vulnerabilities affecting jsonpickle python jsonpickle are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Jsonpickle / python jsonpickle
2.0.0
References
exploit-db.com: https://www.exploit-db.com/exploits/49585 jsonpickle.github.io: https://jsonpickle.github.io github.com: https://github.com/jsonpickle/jsonpickle vulncheck.com: https://www.vulncheck.com/advisories/python-jsonpickle-remote-code-execution-via-py-repr access.redhat.com: https://access.redhat.com/security/cve/CVE-2021-47952 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2478170 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47952.json
Credits
Adi Malyanker, Shay Reuven