CVE-2022-39286: Execution with Unnecessary Privileges in JupyterApp
Impact What kind of vulnerability is it? Who is impacted? We’d like to disclose an arbitrary code execution vulnerability in jupytercore that stems from jupytercore executing untrusted files in the current working directory. This vulnerability allows one user to run code as another.
Patches Has the problem been patched? What versions should users upgrade to? Users should upgrade to jupytercore>=4.11.2.
Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? No
References Are there any links users can visit to find out more? Similar advisory in IPython
Other sources
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupytercore that stems from jupytercore executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39286?
CVE-2022-39286 is an arbitrary code execution vulnerability in Jupyter Core that allows one user to run code as another.
Who is impacted by CVE-2022-39286?
Users of Jupyter Core versions prior to 4.11.2 are impacted by CVE-2022-39286.
What is the severity of CVE-2022-39286?
CVE-2022-39286 has a severity rating of 8.8 (High).
How can I fix CVE-2022-39286?
To fix CVE-2022-39286, update Jupyter Core to version 4.11.2 or higher.
Where can I find more information about CVE-2022-39286?
You can find more information about CVE-2022-39286 on the GitHub Security Advisory page and the NVD website.