CVE-2022-39286

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39286.json",
    "cwe_ids": [
        "CWE-250",
        "CWE-269"
    ]
}

References

Affected packages

Git / github.com/jupyter/jupyter_core

Affected ranges

Type: GIT
Repo: https://github.com/jupyter/jupyter_core
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

a8eac8cb0403e148880f1ae9e71dbb5db6451efe

Affected versions

4.*

4.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.1.0

4.1.1

4.10.0

4.11.0

4.11.1

4.2.0

4.2.1

4.3.0

4.4.0

4.5.0

4.6.0

4.6.1

4.6.2

4.6.3

4.7.0

4.7.0rc0

4.7.1

4.8.0

4.8.2

4.9.0

4.9.0rc0

4.9.1

4.9.1rc0

4.9.2