Advisoriesby IbisJupyterLab vulnerable to SXSS in Markdown Preview
Impact
The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.
A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.
Patches
JupyterLab v4.0.11 was patched.
Workarounds
Users can either disable the table of contents extension by running:
```bash
jupyter labextension disable @jupyterlab/toc-extension:registry
`
References
Vulnerability reported via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyterlab PyPI | >= 4.0.0, < 4.0.11 | 4.0.11 |
| notebook PyPI | >= 7.0.0, < 7.0.7 | 7.0.7 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- BIT-jupyter-base-notebook-2024-22420, BIT-jupyter-notebook-2024-22420, BIT-jupyterlab-2024-22420, CVE-2024-22420, PYSEC-2026-1707, PYSEC-2026-2535
- github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4
- nvd.nist.gov/vuln/detail/CVE-2024-22420
- github.com/jupyterlab/jupyterlab/commit/dda0033cd49449572d077bbecd33b18d8d05f48a
- github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2df
- github.com/jupyterlab/jupyterlab
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H
More Jupyter advisories
All Jupyter
Jupyter server on Windows discloses Windows user password hashCVE-2024-35178fixed in 2.14.1Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie TossingCVE-2024-28233fixed in 4.1.0JupyterLab vulnerable to potential authentication and CSRF tokens leakCVE-2024-22421fixed in 3.6.7 +2jupyter-server errors include tracebacks with path informationCVE-2023-49080fixed in 2.11.2Open Redirect Vulnerability in jupyter-serverCVE-2023-39968fixed in 2.7.2cross-site inclusion (XSSI) of files in jupyter-serverCVE-2023-40170fixed in 2.7.2