python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code.

Affected: Ubuntu:16.04:LTS: jsonpickle, Ubuntu:18.04:LTS: jsonpickle, Ubuntu:20.04:LTS: jsonpickle, Ubuntu:22.04:LTS: jsonpickle, Ubuntu:24.04:LTS: jsonpickle, Ubuntu:25.10: jsonpickle, Ubuntu:26.04:LTS: jsonpickle

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.