CVE-2024-22420: Stored cross site scripting in Markdown Preview in JupyterLab
Impact
The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.
A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.
Patches
JupyterLab v4.0.11 was patched.
Workarounds
Users can either disable the table of contents extension by running:
bash jupyter labextension disable @jupyterlab/toc-extension:registry
References
Vulnerability reported via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
Other sources
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/notebookto a version that resolves this vulnerability.Fixed in 7.0.7 - Upgrade
Upgrade
pip/jupyterlabto a version that resolves this vulnerability.Fixed in 4.0.11 - Upgrade
Upgrade
JupyterLabto a version that resolves this vulnerability.Fixed in 4.0.11 - Configuration
Disable the table of contents extension by running: jupyter labextension disable @jupyterlab/toc-extension:registry
JupyterLab (table of contents extension @jupyterlab/toc-extension) labextension disable @jupyterlab/toc-extension:registry = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22420?
CVE-2024-22420 is considered a high severity vulnerability as it allows attackers to access sensitive data by exploiting user interactions.
How do I fix CVE-2024-22420?
To fix CVE-2024-22420, upgrade the JupyterLab package to version 4.0.11 or later and the Notebook package to version 7.0.7 or later.
What is the impact of CVE-2024-22420?
The impact of CVE-2024-22420 includes unauthorized access to user data and the ability to perform arbitrary requests on behalf of the user.
Which software is affected by CVE-2024-22420?
CVE-2024-22420 affects JupyterLab versions from 4.0.0 to 4.0.10 and Notebook versions from 7.0.0 to 7.0.6.
What user action is required to trigger CVE-2024-22420?
CVE-2024-22420 requires user interaction, specifically opening a malicious notebook or Markdown file in JupyterLab.