PYSEC-2026-1477
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/jupyter-core/PYSEC-2026-1477.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1477
- Aliases
- Published
- 2026-07-07T16:02:53.654510Z
- Modified
- 2026-07-07T17:46:46.038225137Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
- Details
-
Impact
On Windows, the shared
%PROGRAMDATA%directory is searched for configuration files (SYSTEM_CONFIG_PATHandSYSTEM_JUPYTER_PATH), which may allow users to create configuration files affecting other users.Only shared Windows systems with multiple users and unprotected
%PROGRAMDATA%are affected.Mitigations
- upgrade to
jupyter_core>=5.8.1(5.8.0 is patched but breaksjupyter-server) , or - as administrator, modify the permissions on the
%PROGRAMDATA%directory so it is not writable by unauthorized users, or - as administrator, create the
%PROGRAMDATA%\jupyterdirectory with appropriately restrictive permissions, or - as user or administrator, set the
%PROGRAMDATA%environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators or the current user)
Credit
Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932
- upgrade to
- References
-
- https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq
- https://nvd.nist.gov/vuln/detail/CVE-2025-30167
- https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52
- https://github.com/jupyter/jupyter_core
- https://pypi.org/project/jupyter-core
- https://github.com/advisories/GHSA-33p9-3p43-82vq
Affected packages
PyPI / jupyter-core
Package
- Name
- jupyter-core
- View open source insights on deps.dev
- Purl
- pkg:pypi/jupyter-core
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.8.1
Affected versions
4.*
4.0.0.dev
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.1.0
4.1.1
4.2.0
4.2.1
4.3.0
4.4.0
4.5.0
4.6.0
4.6.1
4.6.2
4.6.3
4.7.0rc0
4.7.0
4.7.1
4.8.0b0
4.8.0rc0
4.8.0rc1
4.8.0
4.8.1
4.8.2
4.9.0rc0
4.9.0
4.9.1rc0
4.9.1
4.9.2
4.10.0
4.11.0
4.11.1
4.11.2
4.12.0
5.*
5.0.0rc0
5.0.0rc1
5.0.0rc2
5.0.0
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.6.1
5.7.0
5.7.1
5.7.2
5.8.0