Code injection in rope

CRITICAL 9.8CVE-2014-3539 · GHSA-r38r-qp28-2m63 · PYSEC-2018-100 · Published 06/04/2018 · updated 17/06/2026

In short

CVE-2014-3539 is a CRITICAL (CVSS 9.8) vulnerability affecting rope, rope (rope project).
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.3% of all vulnerabilities.
Fix: update to 0.11.0 or later.

Package	Affected versions	Patched versions
rope PyPI	`< 0.11.0`	`0.11.0`
rope rope_project	`< 0.11.0`	`0.11.0`

Description

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.

NVD description

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.

References

nvd.nist.gov/vuln/detail/CVE-2014-3539 · ADVISORY
python-rope/rope commit b01da7a · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
pypa/advisory-database · WEB
python-rope/rope · PACKAGE
openwall.com/lists/oss-security/2015/02/07/1 · WEB
GitHub Advisory GHSA-r38r-qp28-2m63 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free