GHSA-33p9-3p43-82vq

Source

https://github.com/advisories/GHSA-33p9-3p43-82vq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-33p9-3p43-82vq/GHSA-33p9-3p43-82vq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-33p9-3p43-82vq

Aliases

CVE-2025-30167

Related

CGA-cjgh-vp96-jvvc

Published

2025-06-04T21:00:23Z

Modified

2025-06-04T21:42:22.311752Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Details

Impact

On Windows, the shared %PROGRAMDATA% directory is searched for configuration files (SYSTEM_CONFIG_PATH and SYSTEM_JUPYTER_PATH), which may allow users to create configuration files affecting other users.

Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected.

Mitigations

upgrade to jupyter_core>=5.8.1 (5.8.0 is patched but breaks jupyter-server) , or
as administrator, modify the permissions on the %PROGRAMDATA% directory so it is not writable by unauthorized users, or
as administrator, create the %PROGRAMDATA%\jupyter directory with appropriately restrictive permissions, or
as user or administrator, set the %PROGRAMDATA% environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators or the current user)

Credit

Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932

Database specific

{
    "nvd_published_at": "2025-06-03T17:15:21Z",
    "cwe_ids": [
        "CWE-427"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-04T21:00:23Z"
}

References

Affected packages

PyPI / jupyter-core

Package

Name: jupyter-core; View open source insights on deps.dev
Purl: pkg:pypi/jupyter-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.8.1

Affected versions

4.*

4.0.0.dev

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.1.0

4.1.1

4.2.0

4.2.1

4.3.0

4.4.0

4.5.0

4.6.0

4.6.1

4.6.2

4.6.3

4.7.0rc0

4.7.0

4.7.1

4.8.0b0

4.8.0rc0

4.8.0rc1

4.8.0

4.8.1

4.8.2

4.9.0rc0

4.9.0

4.9.1rc0

4.9.1

4.9.2

4.10.0

4.11.0

4.11.1

4.11.2

4.12.0

5.*

5.0.0rc0

5.0.0rc1

5.0.0rc2

5.0.0

5.1.0

5.1.1

5.1.2

5.1.3

5.1.4

5.1.5

5.2.0

5.3.0

5.3.1

5.3.2

5.4.0

5.5.0

5.5.1

5.6.0

5.6.1

5.7.0

5.7.1

5.7.2

5.8.0

Database specific

{
    "last_known_affected_version_range": "< 5.8.0"
}