PT-2022-6759 · Unknown+5 · Jupyter Core+5

Published 2022-10-26 · Updated 2025-10-20 · CVE-2022-39286

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jupyter Core versions prior to 4.11.2

Description The issue is related to arbitrary code execution in jupyter core due to the execution of untrusted files in the current working directory. This allows one user to run code as another, potentially leading to the disclosure of protected information and the upload and execution of code with elevated privileges.

Recommendations To resolve the issue, upgrade to Jupyter Core version 4.11.2 or later. As a temporary workaround, consider restricting access to the jupyter core functionality until a patch is applied. Avoid executing untrusted files in the current working directory to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Uncontrolled Search Path Element

Weakness Enumeration

CWE-269

CWE-250

CWE-427

Related Identifiers

ALT-PU-2025-7854

BDU:2023-04040

CVE-2022-39286

DLA-3195-1

DSA-5422-1

GHSA-M678-F26J-3HRP

MGASA-2023-0062

PYSEC-2022-42974

USN-6153-1

Affected Products

Alt Linux

Astra Linux

Jupyter Core

Linuxmint

Red Os

Ubuntu

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39286.json · Exploit
• https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283 · Patch
• https://cve.org/CVERecord?id=CVE-2022-39286 · Security Note
• https://osv.dev/vulnerability/GHSA-m678-f26j-3hrp · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KKMP5OXXIX2QAUNVNJZ5UEQFKDYYJVBA · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YIDN7JMLK6AOMBQI4QPSW4MBQGWQ5NIN · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39286 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/YIDN7JMLK6AOMBQI4QPSW4MBQGWQ5NIN · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/695324 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39286 · Vendor Advisory
• https://debian.org/security/2023/dsa-5422 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-42974 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3195 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5422-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39286 · Vendor Advisory