{"action":"Upgrade joblib to 1.2.0 or later.","affected":[{"fixed":"1.2.0","introduced":"0"}],"component":"joblib","cve_ids":["CVE-2022-21797"],"ecosystem":"PyPI","epss":0.02627,"exploited":false,"fixed_versions":["1.2.0"],"ghsa_id":"GHSA-6hrg-qmvc-2xh8","id":"tcs_01M5KGH08C6PV929AC0XBB9FDH","modified_at":"2026-06-10T17:01:53.951213026Z","published_at":"2022-09-26T05:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-288","https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059","https://github.com/joblib/joblib/issues/1128","https://github.com/joblib/joblib/pull/1321","https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033","https://github.com/advisories/GHSA-6hrg-qmvc-2xh8"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-288","url":"https://osv.dev/vulnerability/PYSEC-2022-288"}],"summary":"The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement."}