CVE-2022-39286
Execution with Unnecessary Privileges in JupyterApp
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Execution with Unnecessary Privileges in JupyterApp
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
- Record
CVE-2022-39286- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269, CWE-250
- Updated
- 2026-11-02
EUVDEUVD-2022-0129
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
- Record
EUVD-2022-0129- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m678-f26j-3hrp
Execution with Unnecessary Privileges in JupyterApp
Impact
What kind of vulnerability is it? Who is impacted?
We’d like to disclose an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in the current working directory. This vulnerability allows one user to run code as another.
Patches
Has the problem been patched? What versions should users upgrade to?
Users should upgrade to jupyter_core>=4.11.2.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? No
References
Are there any links users can visit to find out more? Similar advisory in IPython
- Record
GHSA-m678-f26j-3hrp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-250, CWE-269, CWE-427
- Updated
- 2026-11-02
NVD
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
- Record
CVE-2022-39286- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-250, CWE-269, CWE-427
- Updated
- 2026-11-02
OSV
Execution with Unnecessary Privileges in JupyterApp
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
- Record
CVE-2022-39286- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-250, CWE-269
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-39286
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
- Record
DEBIAN-CVE-2022-39286- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSVGHSA-m678-f26j-3hrp
Execution with Unnecessary Privileges in JupyterApp
Impact
What kind of vulnerability is it? Who is impacted?
We’d like to disclose an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in the current working directory. This vulnerability allows one user to run code as another.
Patches
Has the problem been patched? What versions should users upgrade to?
Users should upgrade to jupyter_core>=4.11.2.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? No
References
Are there any links users can visit to find out more? Similar advisory in IPython
- Record
GHSA-m678-f26j-3hrp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-250, CWE-269, CWE-427
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-39286
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
- Record
UBUNTU-CVE-2022-39286- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2023-0062 No score
Updated jupyter-core packages fix security vulnerability
Arbitrary code execution when loading configuration files (CVE-2022-39286)
- Record
MGASA-2023-0062- Updated
- 2026-11-02
OSVPYSEC-2022-42974 No score
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
- Record
PYSEC-2022-42974- Updated
- 2026-11-02
OSVUSN-6153-1 No score
jupyter-core vulnerability
It was discovered that Jupyter Core executed untrusted files in the current working directory. An attacker could possibly use this issue to execute arbitrary code.
- Record
USN-6153-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jupyter-corePyPI |
before 4.11.2 | 4.11.2 |
jupyter-coreDebian:12 |
before 4.11.2-1 | 4.11.2-1 |
jupyter-coreDebian:13 |
before 4.11.2-1 | 4.11.2-1 |
jupyter-coreDebian:14 |
before 4.11.2-1 | 4.11.2-1 |
jupyter-coreDebian:10 |
before 4.4.0-2+deb10u1, plus listed versions 4.4.0-2 |
4.4.0-2+deb10u1 |
jupyter-coreDebian:11 |
before 4.7.1-1+deb11u1, plus listed versions 4.7.1-1 |
4.7.1-1+deb11u1 |
jupyter-corePyPI |
before 4.11.2, plus listed versions 4.0.04.0.0.dev4.0.14.0.24.0.3 Show 31 moreShow less4.0.44.0.54.0.64.1.04.1.14.10.04.11.04.11.14.2.04.2.14.3.04.4.04.5.04.6.04.6.14.6.24.6.34.7.04.7.0rc04.7.14.8.04.8.0b04.8.0rc04.8.0rc14.8.14.8.24.9.04.9.0rc04.9.14.9.1rc04.9.2 |
4.11.2 |
jupyter-coreMageia:8 |
before 4.7.0-1.1.mga8 | 4.7.0-1.1.mga8 |
jupyter-coreUbuntu:Pro:18.04:LTS |
before 4.4.0-2ubuntu0.1~esm1, plus listed versions 4.3.0-14.4.0-14.4.0-2 |
4.4.0-2ubuntu0.1~esm1 |
jupyter-coreUbuntu:Pro:20.04:LTS |
before 4.6.3-3ubuntu0.1~esm1, plus listed versions 4.5.0-24.6.0-14.6.1-14.6.2-1ubuntu14.6.3-3 |
4.6.3-3ubuntu0.1~esm1 |
jupyter-coreUbuntu:Pro:22.04:LTS |
before 4.9.1-1ubuntu0.1~esm1, plus listed versions 4.7.1-14.9.1-1 |
4.9.1-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39286 is a high vulnerability (CVSS 8.8) in Jupyter Core, published October 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in jupyter-core 4.11.2.
References
github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp
lists.debian.org/debian-lts-announce/2022/11/msg00022.html
security.gentoo.org/glsa/202301-04
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDN7JMLK6AOMBQI4QPSW4MBQGWQ5NIN
Show 16 moreShow less
debian.org/security/2023/dsa-5422
nvd.nist.gov/vuln/detail/CVE-2022-39286
security-tracker.debian.org/tracker/CVE-2022-39286
advisories.mageia.org/MGASA-2023-0062.html
bugs.mageia.org/show_bug.cgi?id=31156
ubuntu.com/security/CVE-2022-39286
cve.org/CVERecord?id=CVE-2022-39286