In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes c

Summary

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.

Timeline

1. Oct 3, 2019, 7:51 PM UTCCVE published
2. Aug 5, 2024, 1:10 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• rpycPyPI

  From 4.1.0 · fixed in 4.1.1

• rpycPyPI

  From 4.1.0 · fixed in 4.1.2

References 5