CVE-2024-27758: Rpyc Project Rpyc

High severity, CVSS 8.4. EPSS: 0.5% chance of exploitation in the next 30 days.

In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(client_netref)), a remote attacker can craft a class that results in remote code execution.

Affected products

• Rpyc Project Rpyc: before 6.0.0 (fixed in 6.0.0)

Published 2024-03-12. Last modified 2026-06-17.