joblib 1.6.0

Source: https://github.com/joblib/joblib
Tag scanned: 1.6.0
Compared with: 1.5.3 (1 signals introduced since)
Files: 115 scanned, 58 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 10 info
Scan time: 9.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 05:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution joblib/test/test_func_inspect.py:366:5 new in this release

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    ns = {}
    exec(
        compile(
            "def f(x):\n    return x\n",
```
likely benign LLM, confidence 0.85 A test builds a function from a literal source string via exec and compile.
Reasoning
exec runs compile() on a short literal source string defining a function in a fresh namespace, which is a standard way for a test to create a function whose source is available for inspection. No external input is involved.
info ~~warn~~ → info by review dynamic-execution benchmarks/bench_pickle.py:35:13

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
        try:
            os.system('sudo sh -c "sync; echo 3 > /proc/sys/vm/drop_caches"')
        except IOError as e:
            if e.errno == 13:
```
likely benign LLM, confidence 0.85 A benchmark script calls os.system to drop the page cache before timing runs.
Reasoning
The literal shell command runs `sync` and writes to /proc/sys/vm/drop_caches, a common cache-dropping step in benchmark scripts. It is not obfuscated and has no payload, though it does need sudo, so it is a privileged action worth noting but not malicious in context.
info whitespace-anomaly doc/conf.py:18:1

file mixes tab and space indentation (11 tab-indented and 65 space-indented lines) (raw pass, confidence 0.40)
```
extensions = [
    "sphinx.ext.autodoc",
    "sphinx.ext.imgmath",
    "numpydoc",
```
info ~~critical~~ → info by review dynamic-import joblib/_memmapping_reducer.py:654:29

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            # easy vendoring.
            delete_folder = __import__(
                pool_module_name, fromlist=["delete_folder"]
            ).delete_folder
```
likely benign LLM, confidence 0.85 joblib dynamically imports a module name to get its delete_folder helper.
Reasoning
The `__import__` call loads a vendored module by name, with the name computed from the package layout, to import delete_folder. This is a known joblib pattern for vendoring compatibility. The module name is internal, not attacker-controlled, so the critical severity is overstated.
info ~~warn~~ → info by review decoder-decompress-payload joblib/compressor.py:277:34

file imports decoder module(s) zlib, bz2, lzma and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
            self._mode = _MODE_READ
            self._decompressor = zlib.decompressobj(self.wbits)
            self._buffer = b""
            self._buffer_offset = 0
```
dismissed LLM, confidence 0.90 A streaming zlib decompressor in joblib's compressed file wrapper.
Reasoning
zlib.decompressobj is the streaming decompressor behind joblib's compressed-file reader for its own on-disk format. The data it handles is user cache or pickle files, not an embedded payload, so the decoder-plus-decompress heuristic fires on ordinary compression code.
info ~~warn~~ → info by review decoder-decompress-payload joblib/numpy_pickle_compat.py:58:12

file imports decoder module(s) pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    # buffer to allocate.
    data = zlib.decompress(file_handle.read(), 15, length)
    assert len(data) == length, (
        "Incorrect data length while decompressing %s."
```
likely benign LLM, confidence 0.90 Legacy loader that decompresses a zlib-compressed file and validates its length.
Reasoning
zlib.decompress reads a legacy compressed pickle file with a known length, then checks the decompressed length. This is backward-compatibility code for reading older joblib cache files, not a hidden stage of an attack.
info ~~warn~~ → info by review decoder-import-with-exec joblib/test/test_memory.py:166:9

file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)
```
        my_locals = {}
        exec(
            compile(
                textwrap.dedent(ipython_cell_source),
```
likely benign LLM, confidence 0.85 A test executes IPython cell source to check function caching in interactive sessions.
Reasoning
The exec and compile calls run IPython cell source in a test that checks how joblib handles interactive-cell functions. The source is test data, and the pickle import is for test fixtures, so the multi-stage shape is a false match.
info ~~warn~~ → info by review dynamic-execution joblib/test/test_memory.py:166:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        my_locals = {}
        exec(
            compile(
                textwrap.dedent(ipython_cell_source),
```
likely benign LLM, confidence 0.85 Duplicate flag on the test's exec of IPython cell source.
Reasoning
This is the same exec(compile(...)) call in the IPython cell test, flagged again by the dynamic-execution signal. The executed text is controlled test data, not untrusted input.
info ~~warn~~ → info by review dynamic-execution joblib/test/test_memory.py:167:13

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        exec(
            compile(
                textwrap.dedent(ipython_cell_source),
                filename=ipython_cell_id,
```
likely benign LLM, confidence 0.85 A test compiles IPython cell source for a caching check.
Reasoning
The compile call turns test-provided IPython cell text into code objects with a filename, which the test then executes. It is ordinary test scaffolding for interactive-cell behavior.
info ~~warn~~ → info by review decoder-decompress-payload joblib/test/test_numpy_pickle.py:739:15

file imports decoder module(s) bz2, gzip, pickle, zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
    with open(source_filename, "rb") as fo:
        buf = zlib.decompress(fo.read())

    with open(target_filename, "wb") as fo:
```
likely benign LLM, confidence 0.90 A test helper decompresses a zlib file to create a fixture.
Reasoning
A test helper reads a compressed file with zlib.decompress and writes the result to another file, converting fixture formats. The data comes from local test files, not an embedded payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/joblib/joblib joblib && cd joblib
git checkout 1.6.0
disclude scan --severity info --diff 1.5.3 .