PYSEC-2022-288

🗓️ 26 Sep 2022 05:15:00Reported by GoogleType

osv🔗 osv.dev👁 47 Views

The joblib package (0 to 1.2.0) is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to eval() statement

Reporter	Title	Published	Views	Family All 56
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that enable the assisted mapping capability may be vulnerable to arbitrary code injection due to CVE-2022-21797	4 Nov 202216:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	26 Mar 202503:30	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple Vulnerabilties in Open Source packages affecting IBM Watson Machine Learning Accelerator on Cloud Pak for Data	12 Dec 202317:35	–	ibm
FreeBSD	py39-joblib -- arbitrary code execution	26 Sep 202200:00	–	freebsd
ATTACKERKB	CVE-2022-21797	26 Sep 202205:00	–	attackerkb
AlpineLinux	CVE-2022-21797	26 Sep 202205:05	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в joblib	20 May 202605:53	–	astralinux
CNNVD	joblib 安全漏洞	26 Sep 202200:00	–	cnnvd
CVE	CVE-2022-21797	26 Sep 202205:05	–	cve
Cvelist	CVE-2022-21797 Arbitrary Code Execution	26 Sep 202205:05	–	cvelist

Source	Link
github	www.github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
github	www.github.com/joblib/joblib/issues/1128
github	www.github.com/joblib/joblib/pull/1321
security	www.security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
github	www.github.com/advisories/GHSA-6hrg-qmvc-2xh8

10 Jun 2026 17:01Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.17.3 - 9.8

EPSS0.00265

SSVC