SNYK-PYTHON-JOBLIB-3027033

SNYK-PYTHON-JOBLIB-3027033 PUBLISHED CVSS 9.800000190734863 CRITICAL

## Overview [joblib](https://pypi.org/project/joblib) is a Lightweight pipelining with Python functions Affected versions of this package are vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement. ## PoC ```py def f(): return 1 p = Parallel(n_jobs=3, pre_dispatch="sys.exit(0)") p(delayed(f)() for i in range(10)) # this will cause the system to exit ``` ## Remediation Upgrade `joblib` to version 1.1.1 or higher. ## References - [GitHub Commit](https://github.com/joblib/joblib/commit/54f4d21f098591c77b48c9acfffaa4cf0a45282b) - [GitHub Commit](https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059) - [GitHub Commit](https://github.com/joblib/joblib/pull/1352/commits/01b1ed4b160639e4d72d236cb98b5d9a387e8595) - [GitHub Commit](https://github.com/joblib/joblib/pull/1352/commits/dae0b9353a88e578afc20d651ab507e250a0bfd6) - [GitHub Issue](https://github.com/joblib/joblib/issues/1128) - [GitHub PR](https://github.com/joblib/joblib/pull/1321) - [GitHub PR](https://github.com/joblib/joblib/pull/1327) - [GitHub PR](https://github.com/joblib/joblib/pull/1352)

Risk Scores

CVSS 3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

Affected Products

Vendor	Product	Versions
		0

Timeline

Sep 19, 2022 CVE Updated
Sep 25, 2022 CVE Published

References

Open in Interactive Console →