cve.bz

CVE-2022-35411

9.8 criticalEPSS 47%

Critical (9.8) in rpc.py project rpc.py. EPSS 47% chance of exploitation in the next 30 days.

rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
47% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE
CWE-522
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-8rq8-f485-7v8xPyPIrpc-py>=0.4.2 <=0.6.0no fix published
PYSEC-2026-526PyPIrpc-py>=0.4.2 <=0.6.0no fix published

References

Check your stackJSON