CVE-2021-47952

CriticalCVSS 9.8/10Last modified Jul 15, 2026

Description

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-502

Affected software

VendorProductVersions
Jsonpicklepython jsonpickle2.0.0
Red HatRed Hat Ansible Automation Platform 2—
Red HatRed Hat Ansible Automation Platform 2—

References

Timeline

Published
May 16, 2026
Last modified
Jul 15, 2026
NVD status
Deferred

Related CVEs from 2021

CVE-2021-479534.3OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requeCVE-2021-479548.2LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL CVE-2021-479555.4CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploadinCVE-2021-479568.2EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by inCVE-2021-479576.4Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts byCVE-2021-479584.3CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uCVE-2021-479597.5WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resourceCVE-2021-479606.5A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to CVE-2021-479618.1A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence CVE-2021-479626.4Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows authenticated attackCVE-2021-479637.2Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious paCVE-2021-479648.8Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploa
CVE-2021-47952: Critical severity, CVSS 9.8 | Vulnix