In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16328.json"