{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.4.2"}],"component":"jsonpickle","cve_ids":["CVE-2020-22083"],"ecosystem":"PyPI","epss":0.06495,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-j66q-qmrc-89rx","id":"tcs_01M5KFN7JT8YQKVDPDJDQ2YEPC","modified_at":"2025-02-15T05:29:30.689245Z","published_at":"2022-05-24T17:36:44Z","references":["https://osv.dev/vulnerability/GHSA-j66q-qmrc-89rx","https://nvd.nist.gov/vuln/detail/CVE-2020-22083","https://github.com/jsonpickle/jsonpickle/issues/332","https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494","https://github.com/jsonpickle/jsonpickle/issues/335","https://access.redhat.com/security/cve/CVE-2020-22083","https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874","https://github.com/j0lt-github/python-deserialization-attack-payload-generator","https://github.com/jsonpickle/jsonpickle","https://github.com/pypa/advisory-database/tree/main/vulns/jsonpickle/PYSEC-2020-49.yaml","https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-j66q-qmrc-89rx","url":"https://osv.dev/vulnerability/GHSA-j66q-qmrc-89rx"}],"summary":"jsonpickle unsafe deserialization"}