joblib vulnerabilities

2 known vulnerabilities in joblib from Joblib Project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  joblib: Deserialization of Untrusted Data

  CVE-2024-34997May 17, 2024Joblib Project

  joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.

• 9.8 Critical severity

  joblib: Improper Control of Generation of Code

  CVE-2022-21797Sep 26, 2022JoblibEPSS 2.63%

  The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.