CVE-2019-17206: Uncontrolled Deserialization of Pickled Object in rediswrapper
Summary
CVE-2019-17206: Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts. Affects rediswrapper versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rediswrapper is a Python package available on PyPI that provides a wrapper for Redis, a popular in-memory data structure store. It allows developers to interact with Redis using Python objects and provides convenient methods for working with Redis data types such as hashes, lists, and sets. This vulnerability affects versions prior to 0.3.0 of rediswrapper.
Vulnerability Detail
The vulnerability in rediswrapper (aka Redis Wrapper) before version 0.3.0 arises from uncontrolled deserialization of a pickled object in the models.py file. This allows attackers to execute arbitrary scripts, potentially leading to remote code execution. The vulnerability is rated as critical with a CVSS score of 9.8. The affected functions include rediswrapper.models.HashType.__iter__, rediswrapper.models.HashType.__repr__, rediswrapper.models.ListType.__setitem__, rediswrapper.models.ListType.__getitem__, rediswrapper.models.ListType.__delitem__, rediswrapper.models.ListType.__repr__, rediswrapper.models.ListType.insert, rediswrapper.models.SetType.__repr__, rediswrapper.models.from_value, and rediswrapper.models.to_value.
How To Fix
Latest published version: 0.4.0.post1 as of 23 Oct 2026
pip install --upgrade "rediswrapper==0.4.0.post1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.0
This is the first release that contains the fix.
pip install --upgrade "rediswrapper==0.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The uncontrolled deserialization vulnerability in rediswrapper before version 0.3.0 can lead to remote code execution. Users should upgrade to version 0.3.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rediswrapper →
FAQ
rediswrapper is a Python package that provides a wrapper for Redis, allowing developers to interact with Redis using Python objects.
This vulnerability allows attackers to execute arbitrary scripts, potentially leading to remote code execution.
Versions prior to 0.3.0 of rediswrapper are affected by this vulnerability.
To fix this vulnerability, upgrade to version 0.3.0 or later of rediswrapper.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for rediswrapper.
