CVE-2022-21797

CVE-2022-21797 affects joblib: versions 0 up to 1.1.x are vulnerable to arbitrary code execution via the pre_dispatch flag in Parallel(), caused by an eval() statement. Severity is high/critical per sources; impact is arbitrary code execution. Remediation: upgrade to joblib 1.2.0 or later (e.g., ...

CVE-2024-34997

CVE-2024-34997 affects joblib v1.4.2, with a deserialization vulnerability in the joblib.numpy_pickle::NumpyArrayWrapper().read_array(). The supplier disputes the issue, noting NumpyArrayWrapper is used only for caching trusted content. Affected/linked advisories cite an unsafe pickle-based deser...