Astra Linux – Vulnerability in jupyter-core

Jupyter Core is a package for the core common functionalities of Jupyter projects. Prior to version 4.11.2, Jupyter Core contained an arbitrary code execution vulnerability in “jupytercore,” which stemmed from “jupytercore” executing untrusted files in the CWD environment. This vulnerability...

abracadabra (>=0.0.0, <=0.0.5), ai-economist (>=1.0.0, <=1.1.1) +20 more potentially affected by CVE-2025-30167 via jupyter-core (4.6.3)

jupyter-core PYPI version 4.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - abracadabra =0.0.0, =1.0.0, =0.1.0rc1, =0.0.1, =0.0.4, =1.0.0, =1.1.7, =1.0.2, =0.0.2, =0.0.8, =0.0.1, =0.0.2 - pangsitpy 0.0.3 and more...

dbx-deploy (0.6.1), pycotools3 (2.1.21) potentially affected by CVE-2025-30167 via jupyter-core (4.6.0)

jupyter-core PYPI version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - dbx-deploy 0.6.1 - pycotools3 2.1.21 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

ImpactOn Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration files affecting other users.Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2025-30167 via jupyter-core (4.3.0)

jupyter-core PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

asekuro (>=0.0.4, <=0.0.5), box-oauth (>=0.2.5, <=0.3.1) +3 more potentially affected by CVE-2025-30167 via jupyter-core (4.4.0)

jupyter-core PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - asekuro =0.0.4, =0.2.5, =0.3.4, =0.5.10, =0.5.24 - sphinx-markdown-builder 0.0.5 Source cves: CVE-2025-30167 Source advisory:...

corradin-opioid-project (0.1.0), e2eml (>=0.9.4, <=0.9.9) +6 more potentially affected by CVE-2025-30167 via jupyter-core (4.7.0)

jupyter-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - corradin-opioid-project 0.1.0 - e2eml =0.9.4, =0.0.0, =0.0.2, =0.1.0, =1.0.0, =1.2.0 Source cves: CVE-2025-30167 Source advisory:...

abracadabra (>=0.0.6, <=0.0.7), ai-economist (>=1.2.3, <=1.7.1) +20 more potentially affected by CVE-2025-30167 via jupyter-core (4.7.1)

jupyter-core PYPI version 4.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - abracadabra =0.0.6, =1.2.3, =1.0.1, =0.0.86, =3.0.0a1, =1.0.1, =1.8.0, =1.0.1, =0.1.1.1, =0.0.2, =0.0.6 - neurocat 0.0.1 - omdenalore...

garmindb (3.2.8), geometron (>=0.0.1.dev7, <=0.0.3) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.8.1)

jupyter-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - garmindb 3.2.8 - geometron =0.0.1.dev7, =0.1.0, =1.0.0 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

sphynxml (2.0.0), zrp (>=0.1.8, <=0.1.9) potentially affected by CVE-2025-30167 via jupyter-core (4.9.1)

jupyter-core PYPI version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - sphynxml 2.0.0 - zrp =0.1.8, =0.1.9 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

grater-expectations (>=1.0.0, <=1.2.2), hbac-bias-detection (>=0.1.7, <=0.2.6) +3 more potentially affected by CVE-2025-30167 via jupyter-core (4.9.2)

jupyter-core PYPI version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - grater-expectations =1.0.0, =0.1.7, =0.1.0, =2.1.2 - task-4-5-maihitooy 0.0.1 - xircuits 1.3.0 Source cves: CVE-2025-30167 Source...

deepmtp (>=0.0.5, <=0.0.12), tid-costa-rica-poverty-prediction (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.10.0)

jupyter-core PYPI version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - deepmtp =0.0.5, =0.0.1, =0.12.0, =0.12.1 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

autorad (>=0.2.5.dev0, <=0.2.5), jupyterlab-legos-ui (0.1.4) +2 more potentially affected by CVE-2025-30167 via jupyter-core (4.11.2)

jupyter-core PYPI version 4.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - autorad =0.2.5.dev0, =0.0.3, =9.0.21, =10.0.6 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=1.1.1rc4), callisto-jupyter-d1 (>=0.0.7, <=0.0.18) +19 more potentially affected by CVE-2025-30167 via jupyter-core (4.12.0)

jupyter-core PYPI version 4.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - acryl-datahub-gx-plugin =0.14.0.3rc1, =0.0.7, =0.1.0, =0.1.8, =0.6.0, =1.3.1, =3.14.0, =1.3.1, =1.3.1, =2.2.0, =3.14.0, =1.3.1, =1.0.0,...

ac-solver (0.1.0), airosentris (>=0.1.23, <=0.1.31) +182 more potentially affected by CVE-2025-30167 via jupyter-core (>=5.0.0, <=5.8.0)

jupyter-core PYPI version =5.0.0, =0.1.23, =0.20.0, =0.9.5, =0.1.0, =0.1.0, =1.0.1, =1.0.1, =0.3.1, =0.1.1, =0.1.0, =0.3.0, =0.0.1, =0.0.8.post4 and more Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

pug-nlp (>=0.1.6, <=0.1.14), twip (0.0.6) potentially affected by CVE-2025-30167 via jupyter-core (4.1.0)

jupyter-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - pug-nlp =0.1.6, =0.1.14 - twip 0.0.6 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

eflow (0.1.3), mltronsautodataprep (>=0.0.12, <=0.0.13) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.5.0)

jupyter-core PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - eflow 0.1.3 - mltronsautodataprep =0.0.12, =0.0.7, =0.0.11 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

hclctpm (>=0.0.1, <=0.0.4), nbconvertjkl (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.6.1)

jupyter-core PYPI version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - hclctpm =0.0.1, =0.0.1, =0.0.4 - nerblackbox 0.0.5 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

PYSEC-2026-1477 Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Impact On Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected...

azure-arm-nb-extensions (>=0.0.1, <=0.0.2), e2xgrader (0.1.0.dev1) +11 more potentially affected by CVE-2025-30167 via jupyter-core (4.11.1)

jupyter-core PYPI version 4.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - azure-arm-nb-extensions =0.0.1, =0.0.6, =0.2.8, =9.0.2, =0.3.20, =0.0.4, =1.0.0, =0.3.5.dev2659611866, =0.1.0, =0.2.0, =0.8.0, =1.0.0...