GHSA-m678-f26j-3hrp

Execution with Unnecessary Privileges in JupyterApp

Source: GitHub Advisory Database (reviewed) High CVE-2022-39286

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	jupyter-core	< 4.11.2	4.11.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact _What kind of vulnerability is it? Who is impacted?_ We’d like to disclose an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in the current working directory. This vulnerability allows one user to run code as another. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Users should upgrade to `jupyter_core>=4.11.2`. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ No ### References _Are there any links users can visit to find out more?_ Similar advisory in [IPython](https://github.com/advisories/GHSA-pq7m-3gw7-gq5x)

References

External links from the advisory. They lead to third-party sites.