CVE-2022-21797
Arbitrary Code Execution
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Arbitrary Code Execution
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
CVE-2022-21797- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2022-0128
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
EUVD-2022-0128- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6hrg-qmvc-2xh8
joblib vulnerable to arbitrary code execution
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
GHSA-6hrg-qmvc-2xh8- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
CVE-2022-21797- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-21797
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
ALPINE-CVE-2022-21797- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Arbitrary Code Execution
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
CVE-2022-21797- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P - Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2022-21797
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
DEBIAN-CVE-2022-21797- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVGHSA-6hrg-qmvc-2xh8
joblib vulnerable to arbitrary code execution
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
GHSA-6hrg-qmvc-2xh8- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVOESA-2022-1990
python-joblib security update
Joblib is a set of tools to provide lightweight pipelining in Python.
Security Fix(es):
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.(CVE-2022-21797)
- Record
OESA-2022-1990- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-21797
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
UBUNTU-CVE-2022-21797- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2022-0375 No score
Updated python-joblib packages fix security vulnerability
Arbitrary Code Execution in joblib (CVE-2022-21797)
- Record
MGASA-2022-0375- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10214-1 No score
Security update for python-joblib
This update for python-joblib fixes the following issues:
- CVE-2022-21797: Fixed arbitrary code execution in joblib (boo#1204232)
- Record
openSUSE-SU-2022:10214-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12401-1 No score
python310-joblib-1.2.0-1.1 on GA media
These are all security issues fixed in the python310-joblib-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12401-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14914-1 No score
python311-joblib-1.4.2-2.1 on GA media
These are all security issues fixed in the python311-joblib-1.4.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14914-1- Updated
- 2026-11-02
OSVPYSEC-2022-288 No score
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- Record
PYSEC-2022-288- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
joblibPyPI |
before 1.2.0 | 1.2.0 |
py3-joblibAlpine:v3.17 |
before 1.2.0-r0 | 1.2.0-r0 |
py3-joblibAlpine:v3.18 |
before 1.2.0-r0 | 1.2.0-r0 |
py3-joblibAlpine:v3.19 |
before 1.2.0-r0 | 1.2.0-r0 |
py3-joblibAlpine:v3.20 |
before 1.2.0-r0 | 1.2.0-r0 |
py3-joblibAlpine:v3.21 |
before 1.2.0-r0 | 1.2.0-r0 |
py3-joblibAlpine:v3.22 |
before 1.2.0-r0 | 1.2.0-r0 |
py3-joblibAlpine:v3.23 |
before 1.2.0-r0 | 1.2.0-r0 |
py3-joblibAlpine:v3.24 |
before 1.2.0-r0 | 1.2.0-r0 |
joblibDebian:12 |
before 1.2.0-1 | 1.2.0-1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
joblibDebian:13 |
before 1.2.0-1 | 1.2.0-1 |
joblibDebian:14 |
before 1.2.0-1 | 1.2.0-1 |
joblibDebian:10 |
before 0.13.0-2+deb10u2, plus listed versions 0.13.0-20.13.0-2+deb10u1 |
0.13.0-2+deb10u2 |
joblibPyPI |
before 1.2.0, plus listed versions 0.10.00.10.20.10.30.110.11a3 Show 45 moreShow less0.12.00.12.10.12.20.12.30.12.40.12.50.13.00.13.10.13.20.14.00.14.10.15.00.15.10.16.00.17.00.1a0.1a.dev0.2a.dev0.3.1a.dev0.3.2.dev0.3.2a.dev0.3.2b.dev0.3.2c.dev0.3.2d0.3.2d.dev0.3.2e.dev0.3.2f0.3.2f.dev0.3.2g.dev0.3.3a.dev0.3.3b.dev0.3.3c.dev0.3.4.dev0.3.5.dev0.3.6.dev0.3.7.dev0.3a.dev0.4.0.dev0.4.1.dev0.4.2.dev0.4.3.dev0.4.4.dev0.4.5.dev0.4.6.dev0.5.0.dev |
1.2.0 |
python-joblibMageia:8 |
before 1.2.0-1.mga8 | 1.2.0-1.mga8 |
python-joblibopenEuler:20.03-LTS-SP1 |
before 0.14.0-4.oe1 | 0.14.0-4.oe1 |
python-joblibopenEuler:20.03-LTS-SP3 |
before 0.14.0-4.oe1 | 0.14.0-4.oe1 |
python-joblibopenEuler:22.03-LTS |
before 1.0.0-2.oe2203 | 1.0.0-2.oe2203 |
joblibPyPI |
before 1.2.0, plus listed versions 0.10.00.10.20.10.30.110.11a3 Show 45 moreShow less0.12.00.12.10.12.20.12.30.12.40.12.50.13.00.13.10.13.20.14.00.14.10.15.00.15.10.16.00.17.00.1a0.1a.dev0.2a.dev0.3.1a.dev0.3.2.dev0.3.2a.dev0.3.2b.dev0.3.2c.dev0.3.2d0.3.2d.dev0.3.2e.dev0.3.2f0.3.2f.dev0.3.2g.dev0.3.3a.dev0.3.3b.dev0.3.3c.dev0.3.4.dev0.3.5.dev0.3.6.dev0.3.7.dev0.3a.dev0.4.0.dev0.4.1.dev0.4.2.dev0.4.3.dev0.4.4.dev0.4.5.dev0.4.6.dev0.5.0.dev |
1.2.0 |
joblibUbuntu:14.04:LTS |
All versions, plus listed versions 0.7.0+git14-g3e5784c-10.7.1-1 |
None known |
joblibUbuntu:16.04:LTS |
All versions, plus listed versions 0.8.3-10.9.2-10.9.3-10.9.4-1 |
None known |
joblibUbuntu:18.04:LTS |
All versions, plus listed versions 0.10.3+git55-g660fe5d-10.11-1 |
None known |
joblibUbuntu:20.04:LTS |
All versions, plus listed versions 0.13.0-20.14.0-0ubuntu10.14.0-0.20.14.0-20.14.0-3 |
None known |
joblibUbuntu:22.04:LTS |
All versions, plus listed versions 0.17.0-40.17.0-4ubuntu1 |
None known |
python-joblibSUSE:Package Hub 15 SP3 |
before 0.16.0-bp153.2.3.1 | 0.16.0-bp153.2.3.1 |
python-joblibopenSUSE:Leap 15.3 |
before 0.16.0-bp153.2.3.1 | 0.16.0-bp153.2.3.1 |
python-joblibopenSUSE:Tumbleweed |
before 1.4.2-2.1 | 1.4.2-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-21797 is a high vulnerability (CVSS 7.3) in Joblib Project Joblib, published September 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in joblib 1.2.0.
References
security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF
Show 24 moreShow less
lists.debian.org/debian-lts-announce/2022/11/msg00020.html
security.gentoo.org/glsa/202401-01
nvd.nist.gov/vuln/detail/CVE-2022-21797
security.alpinelinux.org/vuln/CVE-2022-21797
security-tracker.debian.org/tracker/CVE-2022-21797
advisories.mageia.org/MGASA-2022-0375.html
bugs.mageia.org/show_bug.cgi?id=30956
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1990
ubuntu.com/security/CVE-2022-21797
cve.org/CVERecord?id=CVE-2022-21797
lists.opensuse.org/archives/list/[email protected]/thread/K246HPHCUXNTJI75JUOCJN7GHNKHN5EC
bugzilla.suse.com/1204232
suse.com/security/cve/CVE-2022-21797
Left out here: 110 versions. The JSON record has them.