Skip to main content

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-22420

Medium
6.1/10

Summary

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting like the attacked user. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension. This Vulnerability affects NPM's @jupyterlab/markdownviewer-extension, @jupyterlab/markdownviewer, and @jupyterlab/notebook package versions 4.0.0-alpha.10 through 4.0.10, and 4.1.0-alpha.1 through 4.1.0-beta.1 and @jupyterlab/toc package versions 6.0.0-alpha.10 through 6.0.10, and 6.1.0-alpha.1 through 6.1.0-beta.1. This vulnerability also affects Python's notebook package versions 7.0.0a1 through 7.0.6, and jupyterlab package versions 4.0.0a0 through 4.0.10, and 4.1.0a1 through 4.1.0b1.

  • LOW
  • NETWORK
  • LOW
  • CHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-79 - Cross Site Scripting

Cross-Site Scripting, commonly referred to as XSS, is the most dominant class of vulnerabilities. It allows an attacker to inject malicious code into a pregnable web application and victimize its users. The exploitation of such a weakness can cause severe issues such as account takeover, and sensitive data exfiltration. Because of the prevalence of XSS vulnerabilities and their high rate of exploitation, it has remained in the OWASP top 10 vulnerabilities for years.

References

Advisory Timeline

  • Published