CVE-2025-30167: Jupyter core Jupyter Core On Windows Has Vulnerability

HIGH
Advisory Identifier: GHSA-33p9-3p43-82vq
Share
CVSS 7.3
CWE-427
Published
Advisory Summary

CVE-2025-30167 is a HIGH (CVSS 7.3) jupyter core on windows has vulnerability (CWE-427: Uncontrolled Search Path Element) affecting Jupyter core libraries in the PyPI ecosystem. The issue involves jupyter core on windows has uncontrolled search path element local privilege escalation vulnerability. Remediation is available by upgrading affected packages to version 5.8.1.

CVE-2025-30167 at a Glance

CVE Identifier CVE-2025-30167
GHSA Identifier GHSA-33p9-3p43-82vq
Severity HIGH
CVSS v3.1 Base Score 7.3
CWE Classification CWE-427: Uncontrolled Search Path Element
Affected Product Jupyter core
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 7.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2025-30167

To remediate this vulnerability, upgrade all affected Jupyter core dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

jupyter_core fixed: 5.8.1 
pip install jupyter_core>=5.8.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show jupyter_core

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2025-30167, inspect your installed packages using pip:

pip show jupyter_core

Analyze the terminal output to locate any version of Jupyter core in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.8.1), your application is affected.

Note: The pip show jupyter_core command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-427: Uncontrolled Search Path Element, where the product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. In Jupyter core, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Impact On Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. ## Mitigations - upgrade to `jupyter_core>=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or - as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or - as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions, or - as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user) ## Credit Reported via Trend Micro Zero Day Initiative as ZDI-CAN-25932

CVE-2025-30167 Affected Jupyter core Versions

1 component(s)
Fixed Versions:
5.8.1
Product / Package Ecosystem Affected Versions Fixed Version
jupyter_core
pypi/jupyter_core
PyPI
< 5.8.1
5.8.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq
NVD — CVE-2025-30167 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30167
Security Fix Commit FIX COMMIT
https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52
Jupyter core Source Repository REPOSITORY
https://github.com/jupyter/jupyter_core

Frequently Asked Questions

What is CVE-2025-30167?
CVE-2025-30167 is a security vulnerability in Jupyter core involving Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability under CWE-427: Uncontrolled Search Path Element.
Which Jupyter core versions are affected?
Affected versions include releases prior to 5.8.1 across affected packages: jupyter_core.
What version fixes CVE-2025-30167?
Upgrading to 5.8.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is jupyter_core affected?
Yes, jupyter_core is affected in releases prior to 5.8.1. Upgrade your dependency to 5.8.1 or later.
What is the CVSS score of CVE-2025-30167?
CVE-2025-30167 has a CVSS v3.1 base score of 7.3 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2025-30167?
CVE-2025-30167 is classified under CWE-427: Uncontrolled Search Path Element (The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.).
How can I check PyPI dependencies for CVE-2025-30167?
Run the dependency tree command: 'pip show jupyter_core'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-33p9-3p43-82vq",
  "modified" : "2026-01-23T16:31:13Z",
  "published" : "2025-06-04T21:00:23Z",
  "aliases" : [ "CVE-2025-30167" ],
  "summary" : "Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability",
  "details" : "## Impact\n\nOn Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users.\n\nOnly shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected.\n\n## Mitigations\n\n- upgrade to `jupyter_core>=5.8.1` (5.8.0 is patched but breaks `jupyter-server`) , or\n- as administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users, or\n- as administrator, create the `%PROGRAMDATA%\\jupyter` directory with appropriately restrictive permissions, or\n- as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user)\n\n## Credit\n\nReported via Trend Micro Zero Day Initiative as ZDI-CAN-25932",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "jupyter_core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.8.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 5.8.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-30167"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/jupyter/jupyter_core"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-427" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-06-04T21:00:23Z",
    "nvd_published_at" : "2025-06-03T17:15:21Z"
  }
}