Question: why was the vulnerability on jsonpickle<=1.4.1 removed in last november?

[Lucas-C]

Hi,

I just noticed that there used to be a vulnerability reported on jsonpickle<=1.4.1.
It is present in https://github.com/pyupio/safety-db/blob/8539d7b/data/insecure_full.json:

"jsonpickle": [
    {
        "advisory": "Jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. See CVE-2020-22083.",
        "cve": "CVE-2020-22083",
        "id": "pyup.io-39319",
        "more_info_path": "/vulnerabilities/CVE-2020-22083/39319",
        "specs": [
            "<=1.4.1"
        ],
        "v": "<=1.4.1"
    }
]

However in commit 063909b this vulnerability was removed.

What is the reason for that removal?
Is this because this CVE is "disputed"? cf.

• https://www.cvedetails.com/cve/CVE-2020-22083/
• Jsonpickle decode() function unsafely form objects that can lead to Remote code execution jsonpickle/jsonpickle#332 (comment)