CVE-2022-39286: 
Python vulnerability analysis and mitigation

Jupyter Core, a package providing core common functionality for Jupyter projects, contained an arbitrary code execution vulnerability (CVE-2022-39286) in versions prior to 4.11.2. The vulnerability was discovered and disclosed on October 26, 2022, affecting all installations of Jupyter Core version 4.11.1 and earlier (GitHub Advisory).

The vulnerability stems from Jupyter Core executing untrusted files in the current working directory without validating file ownership. The application would automatically load configuration files from the current working directory, which could contain malicious code (Gentoo Security, GitHub Advisory). The vulnerability has been assigned a High severity rating.

This vulnerability allows for privilege escalation where one user could execute code as another user. By writing to a directory that is used as the current working directory for Jupyter Core by another user, attackers could elevate their privileges to those of another user (Gentoo Security).

The vulnerability has been patched in Jupyter Core version 4.11.2. Users are strongly advised to upgrade to this version or later. There are no known workarounds for this vulnerability other than upgrading to the patched version (GitHub Advisory, Gentoo Security).