CVE-2021-47952

CRITICAL

python jsonpickle 2.0.0 Remote Code Execution via py/repr

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-47952. PoCs published by Adi Malyanker.

AI-analyzed exploit summary This exploit demonstrates a deserialization vulnerability in jsonpickle 2.0.0, where malicious input containing 'py/repr' triggers arbitrary code execution via eval(). The payload example shows a time.sleep(10) command embedded in a JSON string.

Description

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.

Exploits (1)

exploitdb WORKING POC
by Adi Malyanker · pythonremotemultiple
https://www.exploit-db.com/exploits/49585

This exploit demonstrates a deserialization vulnerability in jsonpickle 2.0.0, where malicious input containing 'py/repr' triggers arbitrary code execution via eval(). The payload example shows a time.sleep(10) command embedded in a JSON string.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Trivial
Reliability
Reliable
Target: jsonpickle 2.0.0
No auth needed
Prerequisites: ability to pass malicious JSON input to jsonpickle.decode()
devstral-2 · analyzed May 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-49585
https://www.exploit-db.com/exploits/49585
Product product
Official Product Homepage
https://jsonpickle.github.io
Product product
Product Reference
https://github.com/jsonpickle/jsonpickle
Third Party Advisory third-party-advisory
VulnCheck Advisory: python jsonpickle 2.0.0 Remote Code Execution via py/repr
https://www.vulncheck.com/advisories/python-jsonpickle-remote-code-execution-via-py-repr

Scores

CVSS v3 9.8
EPSS 0.0063
EPSS Percentile 45.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-94
Status published
Products (1)
Jsonpickle/python jsonpickle 2.0.0
Published May 16, 2026
Tracked Since May 16, 2026