GitHub Advisoryadvisory · PyPI

GHSA-4952-p58q-6crx JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

MEDIUM Published 2021-08-23 Modified 2024-11-18 Official page ↗
Aliases
CVE-2021-32797
Ecosystem
PyPI
Packages
jupyterlab, notebook
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-75, CWE-79, CWE-87
Reviewed
2021-08-23

Affected packages

• PyPI jupyterlab: < 1.2.21 → fixed in 1.2.21 • PyPI jupyterlab: >= 2.0.0a0, < 2.2.10 → fixed in 2.2.10 • PyPI jupyterlab: >= 2.3.0a0, < 2.3.2 → fixed in 2.3.2 • PyPI jupyterlab: >= 3.0.0a0, < 3.0.17 → fixed in 3.0.17 • PyPI jupyterlab: >= 3.1.0a0, < 3.1.4 → fixed in 3.1.4 • PyPI notebook: < 5.7.11 → fixed in 5.7.11 • PyPI notebook: >= 6.0.0, < 6.4.1 → fixed in 6.4.1

Description

Impact Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook. Patches Patched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21. References OWASP Page on Restricting Form Submissions For more information If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected]. Credit: Guillaume Jeanne from Google

Related

Alias · CVE (1)

  • CVE-2021-32797 JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. vulnerability

Weakness · CWE (3)

  • CWE-75 Failure to Sanitize Special Elements into a Different Plane weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-87 Improper Neutralization of Alternate XSS Syntax weakness

References