Python JSON Logger Remote Code Execution Vulnerability via Missing Dependency

A remote code execution vulnerability has been identified in the Python JSON Logger package, specifically in versions 3.2.0 and 3.2.1. The issue arose from the deletion of the 'msgspec-python313-pre' dependency, which left the name available for reclamation by a third party. If exploited, this vulnerability would allow arbitrary code execution on any user who installed the development dependencies of Python JSON Logger on Python 3.13. The vulnerability has been addressed in version 3.3.0.

Impact

Exploitation of this vulnerability would lead to remote code execution on the user's system.

Reproduction

The vulnerability can be reproduced by installing Python JSON Logger version 3.2.0 or 3.2.1 with the development dependencies on Python 3.13. This can be done using pip, which will automatically include the malicious 'msgspec-python313-pre' dependency if it has been claimed by an attacker.

Remediation

Users can upgrade to Python JSON Logger version 3.3.0 or later to address this vulnerability.