Critical severity9.8NVD Advisory· Published Jul 8, 2022· Updated Jun 17, 2026
CVE-2022-35411
CVE-2022-35411
Description
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
rpc.pyPyPI | >= 0.4.2, <= 0.6.0 | — |
Affected products
3- rpc.py/rpc.pydescription
Patches
Vulnerability mechanics
References
7- github.com/abersheeran/rpc.py/commit/491e7a841ed9a754796d6ab047a9fb16e23bf8bdnvdPatchThird Party AdvisoryWEB
- packetstormsecurity.com/files/167872/rpc.py-0.6.0-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB EntryWEB
- medium.com/%40elias.hohl/remote-code-execution-0-day-in-rpc-py-709c76690c30nvdExploitWEB
- github.com/advisories/GHSA-8rq8-f485-7v8xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-35411ghsaADVISORY
- github.com/abersheeran/rpc.py/issues/22ghsaWEB
- medium.com/@elias.hohl/remote-code-execution-0-day-in-rpc-py-709c76690c30ghsaWEB
News mentions
0No linked articles in our index yet.