CVE-2024-22420
published 2024-01-19CVE-2024-22420: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends…
PriorityP432medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.57%
43.3th percentile
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jupyterlab | < jupyterlab 4.0.11+ds1-1 (forky) | jupyterlab 4.0.11+ds1-1 (forky) |
| fedoraproject | fedora | — | — |
| jupyter | jupyterlab | >= 4.0.0 < 4.0.11 | 4.0.11 |
| jupyter | notebook | >= 7.0.0 < 7.0.7 | 7.0.7 |
| jupyter | notebook | >= 7.0.0 < 7.0.7 | 7.0.7 |
| jupyterlab | jupyterlab | — | — |
| jupyterlab | jupyterlab | >= 0 < 4.0.11+ds1-1 | 4.0.11+ds1-1 |
| jupyterlab | jupyterlab | >= 0 < 4.0.11+ds1-1 | 4.0.11+ds1-1 |
| jupyterlab | jupyterlab | >= 4.0.0 < 4.0.11 | 4.0.11 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
JupyterLab vulnerable to SXSS in Markdown Preview
ghsa·2024-01-19
CVE-2024-22420 [MEDIUM] CWE-79 JupyterLab vulnerable to SXSS in Markdown Preview
JupyterLab vulnerable to SXSS in Markdown Preview
### Impact
The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.
A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.
### Patches
JupyterLab v4.0.11 was patched.
### Workarounds
Users can either disable the table of contents extension by running:
```bash
jupyter labextension disable @jupyterlab/toc-extension:registry
```
### References
Vulnerability reported via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-p
OSV
CVE-2024-22420: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture
osv·2024-01-19·CVSS 6.1
CVE-2024-22420 [MEDIUM] CVE-2024-22420: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.
OSV
JupyterLab vulnerable to SXSS in Markdown Preview
osv·2024-01-19
CVE-2024-22420 [MEDIUM] JupyterLab vulnerable to SXSS in Markdown Preview
JupyterLab vulnerable to SXSS in Markdown Preview
### Impact
The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.
A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.
### Patches
JupyterLab v4.0.11 was patched.
### Workarounds
Users can either disable the table of contents extension by running:
```bash
jupyter labextension disable @jupyterlab/toc-extension:registry
```
### References
Vulnerability reported via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-p
Debian
CVE-2024-22420: jupyterlab - JupyterLab is an extensible environment for interactive and reproducible computi...
vendor_debian·2024·CVSS 6.5
CVE-2024-22420 [MEDIUM] CVE-2024-22420: jupyterlab - JupyterLab is an extensible environment for interactive and reproducible computi...
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.
Scope: local
forky: resolved (fixed in 4.0.11+ds1-1)
sid: resolved (fixed in 4.0.11+ds1-1)
trixie: resolved (fixed in 4.0.11+ds1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2dfhttps://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4https://lists.fedoraproject.org/archives/list/[email protected]/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2dfhttps://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4https://lists.fedoraproject.org/archives/list/[email protected]/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/
2024-01-19
Published