CVE-2022-39286

Execution with Unnecessary Privileges in JupyterApp

State: Published
Severity: 8.8 High
Published: Oct 26, 2022
Updated: Apr 23, 2025
Reserved: Sep 2, 2022

Description

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-269 Improper Privilege Management
CWE-250 Execution with Unnecessary Privileges

Affected Products

Product	Versions
jupyter_corejupyter	< 4.11.2Affected

References

https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp
https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283
[debian-lts-announce] 20221117 [SECURITY] [DLA 3195-1] jupyter-core security updatemailing-list
GLSA-202301-04vendor-advisory
FEDORA-2023-de87bd076bvendor-advisory
FEDORA-2023-d966145959vendor-advisory
DSA-5422vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.