Vulnerability	Vulnerable Version
H Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Attackers can trick the user to open a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature, which will allow them to access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. How to fix Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')? Upgrade `jupyterlab` to version 3.6.8, 4.2.5 or higher.	[,3.6.8)[4.0.0,4.2.5)
M Information Exposure jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Information Exposure due to improper handling of `Authorization` and `XSRFToken` headers. An attacker can expose sensitive tokens to a third party by convincing a user to click on a malicious link when running an old version of the `jupyter-server` component. Exploiting this vulnerability allows potential authentication and CSRF tokens to leak. How to fix Information Exposure? Upgrade `jupyterlab` to version 3.6.7, 4.0.11 or higher.	[,3.6.7)[4.0.0,4.0.11)
H Cross-site Scripting (XSS) jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. How to fix Cross-site Scripting (XSS)? Upgrade `jupyterlab` to version 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.1 or higher.	[3.1.0,3.1.4)[3.0.0,3.0.17)[2.3.0,2.3.2)[2.2.0,2.2.10)[,1.2.1)

Go back to all versions of this package