CVE-2019-16328: RPyC Remote Code Execution
Summary
CVE-2019-16328: In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings. Affects rpyc versions >= 4.1.0, < 4.1.2. Fixed in 4.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RPyC is a Python library that provides remote procedure call (RPC) capabilities over a network. It allows users to execute code on a remote server using a client-server architecture. The library is widely used in various Python applications and services.
Vulnerability Detail
The vulnerability, identified as CVE-2019-16328, exists in RPyC versions 4.1.x through 4.1.1. It allows a remote attacker to dynamically modify object attributes and construct a remote procedure call that executes arbitrary code on an RPyC service. This vulnerability can be exploited when the service is using default configuration settings. An attacker can take advantage of this to gain unauthorized access, perform unauthorized actions, or compromise the integrity of the affected RPyC service.
How To Fix
Latest published version: 6.0.2 as of 22 Oct 2026
pip install --upgrade "rpyc==6.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.2
This is the first release that contains the fix.
pip install --upgrade "rpyc==4.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of RPyC.
Conclusion
The vulnerability in RPyC versions 4.1.x through 4.1.1 allows remote code execution on affected services. To mitigate the risk, it is recommended to upgrade RPyC to version 4.1.2 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for rpyc →
FAQ
RPyC is a Python library that enables remote procedure calls (RPC) over a network. It allows users to execute code on a remote server using a client-server architecture.
This vulnerability allows a remote attacker to execute arbitrary code on an RPyC service with default configuration settings. It can lead to unauthorized access, unauthorized actions, or compromise of the service's integrity.
RPyC versions 4.1.x through 4.1.1 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to a patched version of RPyC.
To fix this vulnerability, upgrade RPyC to version 4.1.2 or later. This version includes a fix for the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for rpyc.
