{"id":"CVE-2024-27758","aliases":["GHSA-h5cg-53g7-gqjw","PYSEC-2024-44"],"url":"https://o3.security/vulnerability/CVE-2024-27758","summary":"RPyC's missing security check results in code execution when using numpy.array on the server-side.","details":"An issue in Open Source: RPyC v.4.00 thru v.5.3.1 allows a remote attacker to execute arbitrary code via a crafted script to the `__array__` attribute component. This vulnerability was introduced in [9f45f826](https://github.com/tomerfiliba-org/rpyc/commit/9f45f8269d4106905db61d82cd529cacdb178911).\n\n### Attack Vector\nRPyC services that rely on the `__array__` attribute used by numpy are impacted. When the server-side exposes a method that calls the attribute named `__array__` for a a client provided netref (e.g., `np.array(client_netref)`), a remote attacker can craft a class which results in remote code execution\n\n### Impact\nAssuming the system exposes a method that calls the attribute `__array__`, an attacker can execute code using the vulnerable component. \n\n### Patches\nThe fix is available in RPyC 6.0.0. The major version change is because some users may need to set `allow_pickle` to `True` when migrating to RPyC 6.\n\n### Workarounds\nWhile the recommend fix is to upgrade to RPyC 6.0.0, the workaround is to [apply bba1d356 as patch.](https://github.com/tomerfiliba-org/rpyc/commit/bba1d3562e6f9f1256ec64048cc23001c0bb7516)\n\n### Affected Component\n[The affected component](https://github.com/tomerfiliba-org/rpyc/blob/5.3.1/rpyc/core/netref.py#L252-L255) is the `__array__` method constructed for `NetrefClass`.\n\n### References\n- [Original disclosure](https://gist.github.com/renbou/957f70d27470982994f12a1d70153d09) by [renbou (Artem Mikheev)](https://gist.github.com/renbou)\n- [CVE-2024-27758](https://nvd.nist.gov/vuln/detail/CVE-2024-27758)\n","published":"2024-03-12T00:00:00Z","modified":"2026-08-12T03:51:08.723661741Z","cvss":{"score":8.4,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"rpyc","fixedVersion":"6.0.0"}],"fix":{"url":"https://github.com/tomerfiliba-org/rpyc/commit/9f45f8269d4106905db61d82cd529cacdb178911","label":"tomerfiliba-org/rpyc@9f45f82"},"references":[{"type":"WEB","url":"https://gist.github.com/renbou/957f70d27470982994f12a1d70153d09"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27758.json"},{"type":"ADVISORY","url":"https://github.com/tomerfiliba-org/rpyc/security/advisories/GHSA-h5cg-53g7-gqjw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27758"},{"type":"WEB","url":"https://github.com/tomerfiliba-org/rpyc/commit/9f45f8269d4106905db61d82cd529cacdb178911"},{"type":"WEB","url":"https://github.com/tomerfiliba-org/rpyc/commit/bba1d3562e6f9f1256ec64048cc23001c0bb7516"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/rpyc/PYSEC-2024-44.yaml"},{"type":"PACKAGE","url":"https://github.com/tomerfiliba-org/rpyc"},{"type":"WEB","url":"https://github.com/tomerfiliba-org/rpyc/blob/5.3.1/rpyc/core/netref.py#L252-L255"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.723661741Z"}}