-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from two connected factors: 1) The PickleSerializer.decode method directly uses unsafe pickle.loads() deserialization. 2) The serializer registry allows clients to activate this dangerous serializer via HTTP headers. The commit fix removes PickleSerializer from these registries, and exploit analysis shows RCE occurs when malicious payloads reach the decode method. Both the deserialization implementation and the serializer selection mechanism are required for the vulnerability to exist.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rpc.py | pip | >= 0.4.2, <= 0.6.0 |
Ongoing coverage of React2Shell