CVE-2022-21797

CVE-2022-21797 affects joblib: versions 0 up to 1.1.x are vulnerable to arbitrary code execution via the pre_dispatch flag in Parallel(), caused by an eval() statement. Severity is high/critical per sources; impact is arbitrary code execution. Remediation: upgrade to joblib 1.2.0 or later (e.g., ...

CVE-2024-34997

The joblib library (specifically version 1.4.2) contains a deserialization vulnerability in the joblib.numpy_pickle::NumpyArrayWrapper().read_array() component. This is caused by the unsafe use of the pickle.load() function, which can allow a local authenticated attacker to execute arbitrary code...