Astra Linux – vulnerability in jupyter-core

Jupyter Core is a package providing the core common functionality for Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupytercore, which arises because jupytercore executes untrusted files in CWD. This vulnerability enables one user to...

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

ImpactOn Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration files affecting other users.Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected...

abracadabra (>=0.0.0, <=0.0.5), ai-economist (>=1.0.0, <=1.1.1) +20 more potentially affected by CVE-2025-30167 via jupyter-core (4.6.3)

jupyter-core PYPI version 4.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - abracadabra =0.0.0, =1.0.0, =0.1.0rc1, =0.0.1, =0.0.4, =1.0.0, =1.1.7, =1.0.2, =0.0.2, =0.0.8, =0.0.1, =0.0.2 - pangsitpy 0.0.3 and more...

grater-expectations (>=1.0.0, <=1.2.2), hbac-bias-detection (>=0.1.7, <=0.2.6) +3 more potentially affected by CVE-2025-30167 via jupyter-core (4.9.2)

jupyter-core PYPI version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - grater-expectations =1.0.0, =0.1.7, =0.1.0, =2.1.2 - task-4-5-maihitooy 0.0.1 - xircuits 1.3.0 Source cves: CVE-2025-30167 Source...

azure-arm-nb-extensions (>=0.0.1, <=0.0.2), e2xgrader (0.1.0.dev1) +11 more potentially affected by CVE-2025-30167 via jupyter-core (4.11.1)

jupyter-core PYPI version 4.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - azure-arm-nb-extensions =0.0.1, =0.0.6, =0.2.8, =9.0.2, =0.3.20, =0.0.4, =1.0.0, =0.3.5.dev2659611866, =0.1.0, =0.2.0, =0.8.0, =1.0.0...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2025-30167 via jupyter-core (4.3.0)

jupyter-core PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

asekuro (>=0.0.4, <=0.0.5), box-oauth (>=0.2.5, <=0.3.1) +3 more potentially affected by CVE-2025-30167 via jupyter-core (4.4.0)

jupyter-core PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - asekuro =0.0.4, =0.2.5, =0.3.4, =0.5.10, =0.5.24 - sphinx-markdown-builder 0.0.5 Source cves: CVE-2025-30167 Source advisory:...

corradin-opioid-project (0.1.0), e2eml (>=0.9.4, <=0.9.9) +6 more potentially affected by CVE-2025-30167 via jupyter-core (4.7.0)

jupyter-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - corradin-opioid-project 0.1.0 - e2eml =0.9.4, =0.0.0, =0.0.2, =0.1.0, =1.0.0, =1.2.0 Source cves: CVE-2025-30167 Source advisory:...

deepmtp (>=0.0.5, <=0.0.12), tid-costa-rica-poverty-prediction (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.10.0)

jupyter-core PYPI version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - deepmtp =0.0.5, =0.0.1, =0.12.0, =0.12.1 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

pug-nlp (>=0.1.6, <=0.1.14), twip (0.0.6) potentially affected by CVE-2025-30167 via jupyter-core (4.1.0)

jupyter-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - pug-nlp =0.1.6, =0.1.14 - twip 0.0.6 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

autorad (>=0.2.5.dev0, <=0.2.5), jupyterlab-legos-ui (0.1.4) +2 more potentially affected by CVE-2025-30167 via jupyter-core (4.11.2)

jupyter-core PYPI version 4.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - autorad =0.2.5.dev0, =0.0.3, =9.0.21, =10.0.6 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=1.1.1rc4), callisto-jupyter-d1 (>=0.0.7, <=0.0.18) +19 more potentially affected by CVE-2025-30167 via jupyter-core (4.12.0)

jupyter-core PYPI version 4.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - acryl-datahub-gx-plugin =0.14.0.3rc1, =0.0.7, =0.1.0, =0.1.8, =0.6.0, =1.3.1, =3.14.0, =1.3.1, =1.3.1, =2.2.0, =3.14.0, =1.3.1, =1.0.0,...

dbx-deploy (0.6.1), pycotools3 (2.1.21) potentially affected by CVE-2025-30167 via jupyter-core (4.6.0)

jupyter-core PYPI version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - dbx-deploy 0.6.1 - pycotools3 2.1.21 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

PYSEC-2026-1477 Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Impact On Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected...

sphynxml (2.0.0), zrp (>=0.1.8, <=0.1.9) potentially affected by CVE-2025-30167 via jupyter-core (4.9.1)

jupyter-core PYPI version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - sphynxml 2.0.0 - zrp =0.1.8, =0.1.9 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

garmindb (3.2.8), geometron (>=0.0.1.dev7, <=0.0.3) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.8.1)

jupyter-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - garmindb 3.2.8 - geometron =0.0.1.dev7, =0.1.0, =1.0.0 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

abracadabra (>=0.0.6, <=0.0.7), ai-economist (>=1.2.3, <=1.7.1) +20 more potentially affected by CVE-2025-30167 via jupyter-core (4.7.1)

jupyter-core PYPI version 4.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - abracadabra =0.0.6, =1.2.3, =1.0.1, =0.0.86, =3.0.0a1, =1.0.1, =1.8.0, =1.0.1, =0.1.1.1, =0.0.2, =0.0.6 - neurocat 0.0.1 - omdenalore...

ac-solver (0.1.0), airosentris (>=0.1.23, <=0.1.31) +181 more potentially affected by CVE-2025-30167 via jupyter-core (>=5.0.0, <=5.8.0)

jupyter-core PYPI version =5.0.0, =0.1.23, =0.20.0, =0.9.5, =0.1.0, =0.1.0, =1.0.1, =1.0.1, =0.3.1, =0.1.1, =0.1.0, =0.3.0, =0.0.1, =0.0.8.post4 and more Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

hclctpm (>=0.0.1, <=0.0.4), nbconvertjkl (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.6.1)

jupyter-core PYPI version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - hclctpm =0.0.1, =0.0.1, =0.0.4 - nerblackbox 0.0.5 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

eflow (0.1.3), mltronsautodataprep (>=0.0.12, <=0.0.13) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.5.0)

jupyter-core PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - eflow 0.1.3 - mltronsautodataprep =0.0.12, =0.0.7, =0.0.11 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...