jsonpickle Remote Code Execution Vulnerability

A remote code execution vulnerability exists in jsonpickle version 2.0.0. This issue allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads that include py/repr objects. The vulnerability arises because the eval function is invoked during the deserialization process, enabling the execution of system commands and arbitrary code. This issue is present in all versions of jsonpickle prior to 2.0.1.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where jsonpickle is used.

Reproduction

To reproduce this vulnerability, craft a JSON string that includes a py/repr directive with a payload that, when evaluated, executes a command or code snippet. Deserialize this crafted JSON using jsonpickles decode function. The payload will be executed on the server, demonstrating the remote code execution vulnerability.

Remediation

Users are advised to update to jsonpickle version 2.0.1 or later, where this vulnerability has been addressed.