Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core     prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration     files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration     files affecting other users. Only shared Windows systems with multiple users and unprotected     `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a     patch. Some other mitigations are available. As administrator, modify the permissions on the     `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the     `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator,     set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions     (e.g. controlled by administrators _or_ the current user). (CVE-2025-30167)

Note that Nessus relies on the presence of the package as reported by the vendor.

The detected version of the Python package, jupyter_core, is prior to 5.8.0. It is, therefore, affected by a vulnerability, as explained in the GHSA-33p9-3p43-82vq advisory. Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators or the current user).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core
    prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration
    files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration
    files affecting other users. Only shared Windows systems with multiple users and unprotected
    `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a
    patch. Some other mitigations are available. As administrator, modify the permissions on the
    `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the
    `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator,
    set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions
    (e.g. controlled by administrators _or_ the current user). (CVE-2025-30167)

ID	Name	Product	Family	Type	Severity
255777	Linux Distros Unpatched Vulnerability : CVE-2025-30167	Nessus	Misc.	Local	high
237906	Python Library jupyter_core < 5.8.0 Uncontrolled Search Path	Nessus	Windows	Local	high
427837	SCA: security update for jupyter_core (GHSA-33p9-3p43-82vq)	Tenable Cloud Security	SCA Checks	Local	high
427837	SCA: security update for jupyter_core (GHSA-33p9-3p43-82vq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-30167

high

Tenable Plugins

high

high

high

high