CVE-2020-22083

jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data

• CWE-502

• https://access.redhat.com/security/cve/CVE-2020-22083Third Party Advisory
• https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874Third Party Advisory
• https://github.com/j0lt-github/python-deserialization-attack-payload-generatorThird Party Advisory
• https://github.com/jsonpickle/jsonpickle/issues/332Third Party Advisory
• https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494Third Party Advisory
• https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/Exploit, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2020-22083Third Party Advisory
• https://gist.github.com/j0lt-github/bb543e77a1a10c33cb56cf23d0837874Third Party Advisory
• https://github.com/j0lt-github/python-deserialization-attack-payload-generatorThird Party Advisory
• https://github.com/jsonpickle/jsonpickle/issues/332Third Party Advisory
• https://github.com/jsonpickle/jsonpickle/issues/332#issuecomment-747807494Third Party Advisory
• https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/Exploit, Third Party Advisory

Published

Dec 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-22057The WinRin0x64.sys and WinRing0.sys low-level drivers in EVG…9.1
• CVE-2020-2206Jenkins VncRecorder Plugin 1.25 and earlier does not escape …6.1
• CVE-2020-22061SUPERAntispyware v8.0.0.1050 was discovered to contain an is…7.8
• CVE-2020-2207Jenkins VncViewer Plugin 1.7 and earlier does not escape a p…6.1
• CVE-2020-22079Stack-based buffer overflow in Tenda AC-10U AC1200 Router US…9.8
• CVE-2020-2208Jenkins Slack Upload Plugin 1.7 and earlier stores a secret …4.3
• CVE-2020-2209Jenkins TestComplete support Plugin 2.4.1 and earlier stores…4.3
• CVE-2020-2210Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier tran…4.3
• CVE-2020-2211Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and e…8.8
• CVE-2020-2212Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stor…4.3
• CVE-2020-22120A remote code execution (RCE) vulnerability in /root/run/adm…8.8
• CVE-2020-22122A SQL injection vulnerability in /oa.php?c=Staff&a=read of F…7.5