CVE-2022-39286

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

• CWE-250
• CWE-269
• CWE-427

• https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283Patch, Third Party Advisory
• https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrpThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00022.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KKMP5OXXIX2QAUNVNJZ5UEQFKDYYJVBA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDN7JMLK6AOMBQI4QPSW4MBQGWQ5NIN/
• https://security.gentoo.org/glsa/202301-04Third Party Advisory
• https://www.debian.org/security/2023/dsa-5422Third Party Advisory
• https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283Patch, Third Party Advisory
• https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrpThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/11/msg00022.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KKMP5OXXIX2QAUNVNJZ5UEQFKDYYJVBA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDN7JMLK6AOMBQI4QPSW4MBQGWQ5NIN/
• https://security.gentoo.org/glsa/202301-04Third Party Advisory
• https://www.debian.org/security/2023/dsa-5422Third Party Advisory

Published

Oct 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39280dparse is a parser for Python dependency files. dparse in ve…7.5
• CVE-2022-39281fat_free_crm is a an open source, Ruby on Rails customer rel…6.5
• CVE-2022-39282FreeRDP is a free remote desktop protocol library and client…7.5
• CVE-2022-39283FreeRDP is a free remote desktop protocol library and client…7.5
• CVE-2022-39284CodeIgniter is a PHP full-stack web framework. In versions p…4.3
• CVE-2022-39285ZoneMinder is a free, open source Closed-circuit television …5.4
• CVE-2022-39287tiny-csrf is a Node.js cross site request forgery (CSRF) pro…6.5
• CVE-2022-39288fastify is a fast and low overhead web framework, for Node.j…7.5
• CVE-2022-39289ZoneMinder is a free, open source Closed-circuit television …7.5
• CVE-2022-3929 Communication between the client and the server application…9.8
• CVE-2022-39290ZoneMinder is a free, open source Closed-circuit television …6.5
• CVE-2022-39291ZoneMinder is a free, open source Closed-circuit television …5.4