Loading story…
A critical remote code execution vulnerability, tracked as CVE-2021-47952, affects the Python jsonpickle library through unsafe deserialization of untrusted JSON. In jsonpickle 2.0.0, applications that pass attacker-controlled data to jsonpickle.decode() can be compromised because the py/repr tag is processed by an internal repr-loading path that forwards input into Python's eval(), allowing arbitrary code execution with the privileges of the running process. The issue requires no authentication, special privileges, or user interaction beyond the target application decoding malicious input.
Public exploit details show the flaw can be triggered remotely with crafted serialized data containing a py/repr field, enabling execution of arbitrary Python commands and potentially system-level calls on both Windows and Linux. Earlier reporting said the behavior existed for backward compatibility across versions and initially lacked a patch, while later project changes reportedly removed reliance on eval() and disabled legacy repr object support by default, reflecting a broader pattern of deserialization risk in the project.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
According to the ZeroPath summary, later jsonpickle releases changed behavior to avoid eval() and disabled legacy repr object support by default, addressing the unsafe deserialization path tied to CVE-2021-47952. The source does not provide a specific date for when these changes were released.
Adi Malyanker and Shay Reuven published an exploit for remote code execution in Python jsonpickle 2.0.0, describing abuse of the "py/repr" deserialization path to execute attacker-controlled code. The report said no patch was available at the time and noted testing on Windows and Linux.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
zeropath.com
Open sourceexploit-db.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical remote code execution (RCE)** vulnerability was disclosed in the PyPI-distributed *PLY (Python Lex-Yacc) 3.11* library, tracked as **CVE-2025-56005** (reported with **CVSS 9.8**). The issue stems from an **undocumented** `picklefile` parameter in `yacc()` that triggers `pickle.load()` on an attacker-controlled file without validation, enabling arbitrary code execution during deserialization (e.g., via `__reduce__()`) before parser initialization completes. Reporting noted the risk is amplified because execution can occur silently at application startup, prior to any parsing logic. Exploitation is feasible in environments where parser tables or build artifacts are cached or shared, including **cached parser table locations**, **shared network directories**, and **CI/CD pipeline artifacts**, if an attacker can influence or replace the referenced pickle file or its path. A proof-of-concept was described demonstrating that a crafted pickle can execute system commands as soon as `yacc(picklefile=...)` is invoked. Separately, a different Python ecosystem issue was also reported: **CVE-2026-0994** in Google *Protocol Buffers* Python JSON parsing (`google.protobuf.json_format.ParseDict()`), where nested `google.protobuf.Any` messages can bypass recursion-depth accounting and crash services via **DoS**—but this is unrelated to the PLY RCE.
Jul 12, 2026
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-61622, was discovered in the Apache Fory Python module, specifically affecting pyfory versions 0.12.0 through 0.12.2 and legacy pyfury versions from 0.1.0 through 0.10.3. The flaw arises from the deserialization of untrusted data, where the module's pickle fallback serializer can be triggered by a crafted data stream, leading to the execution of arbitrary code via Python's 'pickle.loads' function. This vulnerability is considered critical, with a CVSS score of 9.8, indicating a high risk of exploitation. Applications that read pyfory serialized data from untrusted sources are particularly at risk, as attackers can exploit this vector to achieve remote code execution on affected systems. The Apache security team has addressed the issue by removing the pickle fallback serializer in pyfory version 0.12.3 and later, effectively mitigating the vulnerability. Security advisories recommend immediate upgrades to the fixed version to prevent exploitation. The vulnerability was publicly disclosed on October 1, 2025, with Apache providing detailed guidance and crediting their security team for the discovery and remediation. The flaw is remotely exploitable, making it a significant concern for organizations using affected versions in production environments. No evidence of active exploitation in the wild has been reported at the time of disclosure, but the technical simplicity of the attack vector increases the urgency for patching. The vulnerability impacts any application that processes serialized data from untrusted sources using the affected pyfory or pyfury versions. Organizations are advised to audit their environments for the presence of vulnerable versions and to apply the recommended updates without delay. The security community has highlighted the risk of deserialization vulnerabilities in Python applications, emphasizing the importance of avoiding unsafe serialization mechanisms like pickle. Apache's response included not only a patch but also updated documentation warning against insecure deserialization practices. The incident underscores the ongoing risks associated with legacy serialization features in widely used open-source libraries. Security researchers have praised the transparency and speed of Apache's response to the issue. The vulnerability has been cataloged in major vulnerability databases, and security vendors have updated their detection signatures accordingly.
Jun 29, 2026
A critical remote code execution flaw, **`CVE-2026-61447`**, was disclosed in the PraisonAI AI agent framework, affecting versions before **`1.6.78`**. The vulnerability lies in **`CodeAgent._execute_python()`**, which executes LLM-generated Python without AST validation, import restrictions, or sandbox enforcement, allowing attackers to use prompt injection to make the agent run arbitrary code on the host. The issue received the maximum severity rating of **CVSS 10.0** under both v3.1 and v4.0. Successful exploitation can result in full host compromise and theft of sensitive data, including API keys, cloud credentials, database passwords, and other environment secrets, with potential pivoting into connected services. PraisonAI **`1.6.78`** fixes the issue, and defenders are being urged to upgrade immediately, reduce network exposure, rotate potentially exposed secrets, and monitor for anomalous outbound connections; no confirmed in-the-wild exploitation had been reported at disclosure time.
Jul 11, 2026