~ / search / GHSA-4952-p58q-6crx

GHSA-4952-p58q-6crx

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-32797

Packages

EcosystemPackageAffectedFixed in
PyPI jupyterlab < 1.2.21 1.2.21
PyPI jupyterlab >= 2.0.0a0, < 2.2.10 2.2.10
PyPI jupyterlab >= 2.3.0a0, < 2.3.2 2.3.2
PyPI jupyterlab >= 3.0.0a0, < 3.0.17 3.0.17
PyPI jupyterlab >= 3.1.0a0, < 3.1.4 3.1.4
PyPI notebook < 5.7.11 5.7.11
PyPI notebook >= 6.0.0, < 6.4.1 6.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook. ### Patches Patched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21. ### References [OWASP Page on Restricting Form Submissions](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) ### For more information If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected]. Credit: Guillaume Jeanne from Google

References

External links from the advisory. They lead to third-party sites.