In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
CVSS 3.1HIGH 7.5·Network·No auth·No interaction·EPSS 0.13049·Published 2019-10-03·Fixed in 4.1.1CWE-1321