Description
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | joblib | < unspecified, unspecified – < 1.2.0 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | joblib | 1.2.0-1 | — |
| Debian 13 | joblib | 1.2.0-1 | — |
| Debian 12 | joblib | 1.2.0-1 | — |
| Debian 10 | joblib | 0.13.0-2+deb10u2 | DLA-3193-2 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | joblib | No fix yet | — |
| Ubuntu 20.04 LTS | joblib | No fix yet | — |
| Ubuntu 18.04 LTS | joblib | No fix yet | — |
| Ubuntu 16.04 LTS | joblib | No fix yet | — |
| Ubuntu 14.04 LTS | joblib | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP3 | python-joblib | 0.16.0-bp153.2.3.1 | openSUSE-SU-2022:10214-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-joblib | 1.4.2-2.1 | openSUSE-SU-2025:14914-1 |
| openSUSE Leap 15.3 | python-joblib | 0.16.0-bp153.2.3.1 | openSUSE-SU-2022:10214-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-joblib | 1.2.0-r0 | — |
| Alpine v3.23 | py3-joblib | 1.2.0-r0 | — |
| Alpine v3.22 | py3-joblib | 1.2.0-r0 | — |
| Alpine v3.21 | py3-joblib | 1.2.0-r0 | — |
| Alpine v3.20 | py3-joblib | 1.2.0-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-joblib | 1.2.0-r0 | — |
| Alpine v3.18 | py3-joblib | 1.2.0-r0 | — |
| Alpine v3.17 | py3-joblib | 1.2.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | joblib | < 1.2.0 | 1.2.0 | GHSA-6hrg-qmvc-2xh8 |
Advisories 4
- DLA-3193-2 joblib - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2022:10214-1 Security update for python-joblib SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14914-1 python311-joblib-1.4.2-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2024-0299 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jul 17, 2024
References
- https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
- https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
- https://github.com/joblib/joblib/issues/1128
- https://github.com/joblib/joblib/pull/1321
- FEDORA-2022-c0bfe37ae5 vendor-advisory
- FEDORA-2022-c83ce1c000 vendor-advisory
- [debian-lts-announce] 20221117 [SECURITY] [DLA 3193-1] joblib security update mailing-list
- [debian-lts-announce] 20230330 [SECURITY] [DLA 3193-2] joblib security update mailing-list
- GLSA-202401-01 vendor-advisory