AIKIDO-2024-10002
rpyc is vulnerable to Remote Code Execution (RCE)
80
High Risk
This Affects:
rpycTL;DR
A Remote Code Execution (RCE) vulnerability was discreetly patched in version 6.0.0 of rpyc. This exploit is only possible when the server-side accesses the __array__ attribute and invokes it, such as through np.array(x).
Who does this affect?
You are affected by this flaw if you use a version >= 4.0.0 and = 5.3.1 of this package.
Background info
rpyc is vulnerable to Remote Code Execution (RCE) in versions 4.0.0 - 5.3.1.
How to fix this
To fix, upgrade to rpyc 6.0.0 or above.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.