In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| rpyc(PyPI) | 4.1.0 | 4.1.1 | N/A |
CVSS Metrics
