CVE-2025-27607
High
Description
Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing dependency. This occurred because msgspec-python313-pre was deleted by the owner leaving the name open to being claimed by a third party. If the package was claimed, it would allow them RCE on any Python JSON Logger user who installed the development dependencies on Python 3.13 (e.g. pip install python-json-logger[dev]). This issue has been resolved with 3.3.0.
SeverityHigh
CVSS8.8
Exploit probability—
ProductNhairs Python Json Logger
PublishedMar 7, 2025
First seenMar 7, 2025
Weakness typeCWE-829CWE-829
How to fix
Update
- nhairs python_json_logger3.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nhairs python_json_logger | v < 3.3.0 | 3.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.