CVE-2022-21797
published 2022-09-26CVE-2022-21797: The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.08%
79.5th percentile
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | joblib | < joblib 1.2.0-1 (bookworm) | joblib 1.2.0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| joblib_project | joblib | < unspecified | unspecified |
| joblib_project | joblib | < 1.1.1 | 1.1.1 |
| joblib_project | joblib | >= 0 < 0.17.0-4+deb11u1 | 0.17.0-4+deb11u1 |
| joblib_project | joblib | >= 0 < 1.2.0-1 | 1.2.0-1 |
| joblib_project | joblib | >= 0 < 1.2.0-1 | 1.2.0-1 |
| joblib_project | joblib | >= 0 < 1.2.0-1 | 1.2.0-1 |
| joblib_project | joblib | >= 0 < 1.2.0 | 1.2.0 |
| joblib_project | joblib | >= unspecified < 1.2.0 | 1.2.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_oracle9.8HIGH
vendor_debian7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
joblib vulnerable to arbitrary code execution
osv·2022-09-27
CVE-2022-21797 [CRITICAL] joblib vulnerable to arbitrary code execution
joblib vulnerable to arbitrary code execution
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement.
GHSA
joblib vulnerable to arbitrary code execution
ghsa·2022-09-27
CVE-2022-21797 [CRITICAL] CWE-94 joblib vulnerable to arbitrary code execution
joblib vulnerable to arbitrary code execution
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement.
OSV
CVE-2022-21797: The package joblib from 0 and before 1
osv·2022-09-26·CVSS 9.8
CVE-2022-21797 [CRITICAL] CVE-2022-21797: The package joblib from 0 and before 1
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Oracle
Oracle Oracle Analytics Risk Matrix: Pipeline Test Failures (Joblib) — CVE-2022-21797
vendor_oracle·2024-07-15·CVSS 9.8
CVE-2022-21797 [HIGH] Oracle Oracle Analytics Risk Matrix: Pipeline Test Failures (Joblib) — CVE-2022-21797
Oracle Oracle Analytics Risk Matrix: Pipeline Test Failures (Joblib) vulnerability
CVE: CVE-2022-21797
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Debian
CVE-2022-21797: joblib - The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Exec...
vendor_debian·2022·CVSS 7.3
CVE-2022-21797 [HIGH] CVE-2022-21797: joblib - The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Exec...
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Scope: local
bookworm: resolved (fixed in 1.2.0-1)
bullseye: resolved (fixed in 0.17.0-4+deb11u1)
forky: resolved (fixed in 1.2.0-1)
sid: resolved (fixed in 1.2.0-1)
trixie: resolved (fixed in 1.2.0-1)
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, July 2024 Security Update Review
blogs_qualys·2024-07-17
Oracle Critical Patch Update, July 2024 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle released its third quarterly edition of Critical Patch Update, which contains patches for 386 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In the third quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 95, constituting about 24% of the total patches released. Oracle Financial Services Applications and Oracle Fusion Middleware foll
Qualys
Oracle Critical Patch Security Update: July 2024 Review | Qualys
blogs_qualys·2024-07-17
Oracle Critical Patch Security Update: July 2024 Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle released its third quarterly edition of Critical Patch Update, which contains patches for 386 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In the third quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 95, constituting about 24% of the total patches released. Oracle Financial Services Applications and Oracle Fusion Middlewa
arXiv
VulnRepairEval: An Exploit-Based Evaluation Framework for Assessing Large Language Model Vulnerability Repair Capabilities
arxiv_fulltext·2025-09-03
VulnRepairEval: An Exploit-Based Evaluation Framework for Assessing Large Language Model Vulnerability Repair Capabilities
: An Exploit-Based Evaluation Framework for Assessing Large Language Model Vulnerability Repair Capabilities
Weizhe Wang
Co-first author.
Tianjin University
China
Wei Ma
[1]
Singapore Management University
Singapore
Qiang Hu
Tianjin University
China
Yao Zhang
Corresponding author. [email protected], [email protected]
Tianjin University
China
Jianfei Sun
Singapore Management University
Singapore
Bin Wu
Tianjin University
China
Yang Liu
Nanyang Technological University
Singapore
Guangquan Xu
[2]
Tianjin University
China
Lingxiao Jiang
Singapore Management University
Singapore
Wang and Ma et al.
software vulnerability repair, LLM, exploit-based evaluation, benchmark
## Abstract
The adoption of Large Language Models (LLMs) for automated software vulnerability patching has sh
https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059https://github.com/joblib/joblib/issues/1128https://github.com/joblib/joblib/pull/1321https://lists.debian.org/debian-lts-announce/2022/11/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2023/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF/https://security.gentoo.org/glsa/202401-01https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059https://github.com/joblib/joblib/issues/1128https://github.com/joblib/joblib/pull/1321https://lists.debian.org/debian-lts-announce/2022/11/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2023/03/msg00027.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MJ5XTJS6OKJRRVXWFN5J67K3BYPEOBDF/https://security.gentoo.org/glsa/202401-01https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
2022-09-26
Published