Joblib Project vulnerabilities
We track 2 vulnerabilities in Joblib Project products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 17, 2024.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Joblib Project vulnerabilities
- 7.5 High severity
joblib: Deserialization of Untrusted Data
joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.
- 9.8 Critical severity
joblib: Improper Control of Generation of Code
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.