Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Mitigations - upgrade to `jupyter_core>=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or - as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or - as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or - as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user) Credit Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932
Recommended action: Upgrade to 5.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? We’d like to disclose an arbitrary code execution vulnerability in jupytercore that stems from jupytercore executing untrusted files in the current working directory. This vulnerability allows one user to run code as another. Patches Has the problem been patched? What versions should users upgrade to? Users should upgrade to jupytercore=4.11.2. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? No References Are there any links users can visit to find out more? Similar advisory in IPython
Recommended action: Upgrade to 4.11.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.