{"action":"Upgrade jsonpickle to 1.4.2 or later.","affected":[{"fixed":"1.4.2","introduced":"0"}],"component":"jsonpickle","cve_ids":["CVE-2020-22083"],"ecosystem":"PyPI","epss":0.06495,"exploited":false,"fixed_versions":["1.4.2"],"ghsa_id":"GHSA-j66q-qmrc-89rx","id":"tcs_01M5KGAPMPXHD4FZ07P7VHTTSA","modified_at":"2026-06-10T17:01:50.041049802Z","published_at":"2020-12-17T16:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-49","https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874","https://github.com/jsonpickle/jsonpickle/issues/332","https://github.com/j0lt-github/python-deserialization-attack-payload-generator","https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/","https://access.redhat.com/security/cve/CVE-2020-22083","https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494","https://github.com/advisories/GHSA-j66q-qmrc-89rx"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-49","url":"https://osv.dev/vulnerability/PYSEC-2020-49"}],"summary":"** DISPUTED ** jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and cle"}