GitHub Advisoryadvisory · PyPI

GHSA-4m77-cmpx-vjc4 JupyterLab vulnerable to SXSS in Markdown Preview

MEDIUM Published 2024-01-19 Modified 2024-01-26 Official page ↗
Aliases
CVE-2024-22420
Ecosystem
PyPI
Packages
jupyterlab, notebook
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-01-19

Affected packages

• PyPI jupyterlab: >= 4.0.0, < 4.0.11 → fixed in 4.0.11 • PyPI notebook: >= 7.0.0, < 7.0.7 → fixed in 7.0.7

Description

Impact The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. Patches JupyterLab v4.0.11 was patched. Workarounds Users can either disable the table of contents extension by running: ```bash jupyter labextension disable @jupyterlab/toc-extension:registry ``` References Vulnerability reported via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

Related

Alias · CVE (1)

  • CVE-2024-22420 JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References