CVE-2023-48887
Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Record
CVE-2023-48887- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Record
CVE-2023-48887- Updated
- 2026-11-02
EUVDEUVD-2023-3129 No score
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Record
EUVD-2023-3129- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6pqx-v9g4-5hc8
Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Record
GHSA-6pqx-v9g4-5hc8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-502
- Updated
- 2026-11-02
OSVGHSA-6pqx-v9g4-5hc8
Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Record
GHSA-6pqx-v9g4-5hc8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502, CWE-94
- Updated
- 2026-11-02
OSV No score
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
- Record
CVE-2023-48887- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jupiter-rpc:jupiter-rpcMaven |
through 1.3.1 | None known |
org.jupiter-rpc:jupiter-rpcMaven |
through 1.3.1, plus listed versions 1.2.01.2.11.2.101.2.111.2.12 Show 32 moreShow less1.2.131.2.141.2.151.2.161.2.171.2.181.2.18.Beta1.2.18.Beta21.2.18.Beta31.2.18.Beta41.2.191.2.19.Beta11.2.19.Beta21.2.19.Beta31.2.21.2.201.2.211.2.221.2.231.2.241.2.251.2.261.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.1-beta-11.3.1-beta-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-48887 is a critical vulnerability (CVSS 9.8) in Fengjiachun Jupiter, published December 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. No source names a fixed version.