{"action":"Upgrade joblib to 1.2.0 or later.","affected":[{"fixed":"1.2.0","introduced":"0"}],"component":"joblib","cve_ids":["CVE-2022-21797"],"ecosystem":"PyPI","epss":0.02627,"exploited":false,"fixed_versions":["1.2.0"],"ghsa_id":"GHSA-6hrg-qmvc-2xh8","id":"tcs_01M5KF3HWTEE2X4216WK53PM7M","modified_at":"2025-02-14T05:27:38.075091Z","published_at":"2022-09-27T00:00:22Z","references":["https://osv.dev/vulnerability/GHSA-6hrg-qmvc-2xh8","https://nvd.nist.gov/vuln/detail/CVE-2022-21797","https://github.com/joblib/joblib/issues/1128","https://github.com/joblib/joblib/pull/1321","https://github.com/joblib/joblib/pull/1327","https://github.com/joblib/joblib/pull/1352","https://github.com/joblib/joblib/commit/6638b9e9711ad1ebbf6dd95aa7cee0dca9897b42","https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059","https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033","https://security.gentoo.org/glsa/202401-01","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF","https://lists.debian.org/debian-lts-announce/2023/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00020.html","https://github.com/pypa/advisory-database/tree/main/vulns/joblib/PYSEC-2022-288.yaml","https://github.com/joblib/joblib"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-6hrg-qmvc-2xh8","url":"https://osv.dev/vulnerability/GHSA-6hrg-qmvc-2xh8"}],"summary":"joblib vulnerable to arbitrary code execution"}