GitHub Advisoryadvisory · PyPI

GHSA-6hrg-qmvc-2xh8 joblib vulnerable to arbitrary code execution

CRITICAL Published 2022-09-27 Modified 2024-09-23 Official page ↗
Aliases
CVE-2022-21797
Ecosystem
PyPI
Packages
joblib
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-09-30

Affected packages

• PyPI joblib: < 1.2.0 → fixed in 1.2.0

Description

The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement.

Related

Alias · CVE (1)

  • CVE-2022-21797 The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References