CVE-2020-22083: Remote Code Execution in jsonpickle
Summary
CVE-2020-22083: DISPUTED jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Affects jsonpickle versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Also tracked for
- jsonpickle · Debian:11
The same CVE-2020-22083 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jsonpickle is a Python library that allows for the serialization and deserialization of complex Python objects to and from JSON. It is commonly used to store and exchange data in a human-readable format. However, jsonpickle versions up to 1.4.1 are vulnerable to remote code execution during the deserialization process. This vulnerability arises from the use of the pickle module, which is known for its potential to execute arbitrary code. It is important to note that pickle should never be used with untrusted data.
Vulnerability Detail
The vulnerability in jsonpickle allows an attacker to execute malicious code by providing a specially crafted payload during the deserialization process. This can lead to various security risks, including unauthorized access, data breaches, and remote code execution. It is crucial to exercise caution when using jsonpickle and ensure that only trusted data is deserialized.
How To Fix
Latest published version: 4.1.4 as of 22 Oct 2026
pip install --upgrade "jsonpickle==4.1.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.2
This is the first release that contains the fix.
pip install --upgrade "jsonpickle==1.4.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of jsonpickle to mitigate the risk of remote code execution.
Conclusion
The vulnerability in jsonpickle can lead to remote code execution and other security risks. It is crucial to update to jsonpickle version 1.4.2 or later to mitigate this vulnerability. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsonpickle →
FAQ
jsonpickle is a Python library used for serializing and deserializing complex Python objects to and from JSON. It provides a convenient way to store and exchange data in a human-readable format.
The vulnerability in jsonpickle allows an attacker to execute arbitrary code during the deserialization process. This can lead to unauthorized access, data breaches, and remote code execution.
To fix this vulnerability, you should upgrade to jsonpickle version 1.4.2 or later. Updating the library to the latest version will ensure that the vulnerability is patched.
There is no known workaround for this vulnerability. It is crucial to update to the patched version of jsonpickle to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can provide a malicious payload during the deserialization process to execute arbitrary code.
Related vulnerabilities
Recent vulnerabilities recorded for jsonpickle.
