CVE-2024-22420 — Cross-site Scripting in Jupyterlab

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
6.1MEDIUMNVD
CNA6.5
EPSS
0.3%
top 43.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
JupyterlabJupyter JupyterlabJupyter Notebook+1 more
Timeline
PublishedJan 19

Description

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disa…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages6 packages

▶NVDjupyter/jupyterlab4.0.0 — 4.0.11
▶PyPIjupyterlab/jupyterlab4.0.0 — 4.0.11
▶Debianjupyterlab/jupyterlab< 4.0.11+ds1-1+1
▶CVEListV5jupyterlab/jupyterlab>=4.0.0, < 4.0.11
▶NVDjupyter/notebook7.0.0 — 7.0.7

Also affects: Fedora 39

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
JupyterLab vulnerable to SXSS in Markdown Preview↗2024-01-19
▶
OSV
CVE-2024-22420: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture↗2024-01-19
▶
OSV
JupyterLab vulnerable to SXSS in Markdown Preview↗2024-01-19
▶
CVEList
Stored cross site scripting in Markdown Preview in JupyterLab↗2024-01-19
▶

📋Vendor Advisories

1
Debian
CVE-2024-22420: jupyterlab - JupyterLab is an extensible environment for interactive and reproducible computi...↗2024
▶
CVE-2024-22420 — Cross-site Scripting in Jupyterlab | cvebase