GHSA-4m77-cmpx-vjc4

JupyterLab vulnerable to SXSS in Markdown Preview

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-22420

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	jupyterlab	>= 4.0.0, < 4.0.11	4.0.11
PyPI	notebook	>= 7.0.0, < 7.0.7	7.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. ### Patches JupyterLab v4.0.11 was patched. ### Workarounds Users can either disable the table of contents extension by running: ```bash jupyter labextension disable @jupyterlab/toc-extension:registry ``` ### References Vulnerability reported via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).

References

External links from the advisory. They lead to third-party sites.