CVE-2021-47952: jsonpickle 2.0.0 (Python) Remote Code Execution via py/repr

Overview

CVE-2021-47952 affects jsonpickle 2.0.0, a Python library used to serialize and deserialize Python objects as JSON. The NVD entry describes a remote code execution issue in which crafted JSON containing py/repr objects causes arbitrary Python commands to run during deserialization, because the eval function is invoked. The weakness is mapped to CWE-94 (Code Injection), and the CNA is VulnCheck.

Impact

• As described in the record, successful exploitation would allow execution of arbitrary Python code in the context of the application that deserializes the input.
• VulnCheck's CVSS 3.1 base score is 9.8 (critical), with a vector indicating network reachability, low attack complexity, no required privileges and no user interaction.
• VulnCheck also reports a CVSS 4.0 score of 9.3.
• The CVSS 3.1 vector rates confidentiality, integrity and availability impacts as high.

Affected products and versions

• The record lists jsonpickle version 2.0.0 as affected.
• Whether other versions are affected is unknown from the available record.
• Upstream sources: jsonpickle on GitHub and the project documentation.

Exploitation status

• This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in this record.
• No confirmed exploitation in the wild appears in the sources consulted.
• The SSVC exploitation value is poc, which indicates that a proof-of-concept is known. The record also references an Exploit-DB entry, whose content is not reproduced here.
• EPSS gives a probability of 0.00696 and a percentile of 0.51766, dated 2026-10-13.

Remediation and mitigation

• The record lists no fixed versions. This is unknown, not evidence that no fix exists. Check the VulnCheck advisory and the upstream project for current guidance.
• Do not deserialize JSON from untrusted sources with jsonpickle. Treat data from users, external APIs and message queues as untrusted.
• Where possible, replace object-reconstructing deserialization with plain data formats that do not instantiate objects or evaluate code.
• Inventory applications and transitive dependencies that use jsonpickle, and prioritize internet-facing services.
• Apply upstream or vendor fixes once verified, and retest the affected workflows after updating.

Detection guidance

• Review application logs for deserialization errors or unexpected objects when processing JSON payloads.
• Monitor for unexpected child processes or outbound connections started by Python services that handle JSON input.
• At a high level, review inbound request bodies that contain jsonpickle type markers, using web application firewall or API gateway logs.

Limitations of the available information

• No fixed version is listed in the record.
• The record does not include NVD CVSS scores; only the VulnCheck scores are present.
• The full range of affected versions beyond 2.0.0 is unknown.
• A Red Hat CVE page and a Red Hat Bugzilla entry are referenced, but their content was not part of the record.
• Real-world prevalence and exploitation attempts are unknown.

Frequently asked questions

Is CVE-2021-47952 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation value is poc, meaning a proof-of-concept is known.

Is there a fixed version of jsonpickle for this issue?

The record lists no fixed versions. This is unknown, not confirmed absent, so check the VulnCheck advisory and the upstream project for current guidance.

What should teams do now?

Avoid deserializing untrusted JSON with jsonpickle, inventory where it is used including transitive dependencies, prioritize internet-facing services, and apply verified upstream fixes when available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.