Execution with Unnecessary Privileges in JupyterApp

高 8.8CVE-2022-39286 · GHSA-m678-f26j-3hrp · PYSEC-2022-42974 · 26/10/2022 公開 · 17/06/2026 更新

要点

CVE-2022-39286 は jupyter-core, jupyter core (jupyter) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 73.3% より高い）。
対処：4.11.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
jupyter-core PyPI	`< 4.11.2`	`4.11.2`
jupyter core jupyter	`< 4.11.2`	`4.11.2`

概要

Impact

What kind of vulnerability is it? Who is impacted? We’d like to disclose an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in the current working directory. This vulnerability allows one user to run code as another.

Patches

Has the problem been patched? What versions should users upgrade to? Users should upgrade to jupyter_core>=4.11.2.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading? No

References

Are there any links users can visit to find out more? Similar advisory in IPython

NVD の説明

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.