jupyterlab@0.35.4 vulnerabilities

jupyterlab is a JupyterLab computational environment.

Affected versions of this package are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Attackers can trick the user to open a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature, which will allow them to access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.

Upgrade jupyterlab to version 3.6.8, 4.2.5 or higher.

jupyterlab is a JupyterLab computational environment.

Affected versions of this package are vulnerable to Information Exposure due to improper handling of Authorization and XSRFToken headers. An attacker can expose sensitive tokens to a third party by convincing a user to click on a malicious link when running an old version of the jupyter-server component. Exploiting this vulnerability allows potential authentication and CSRF tokens to leak.

Upgrade jupyterlab to version 3.6.7, 4.0.11 or higher.

jupyterlab is a JupyterLab computational environment.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html <form>. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.

Upgrade jupyterlab to version 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.1 or higher.