Homepage
About Snyk

jupyterlab@3.4.0rc0 vulnerabilities

JupyterLab computational environment

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the jupyterlab package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

jupyterlab is a JupyterLab computational environment.

Affected versions of this package are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Attackers can trick the user to open a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature, which will allow them to access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.

How to fix Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')?

Upgrade jupyterlab to version 3.6.8, 4.2.5 or higher.

[,3.6.8) [4.0.0,4.2.5)
  • M
Information Exposure

jupyterlab is a JupyterLab computational environment.

Affected versions of this package are vulnerable to Information Exposure due to improper handling of Authorization and XSRFToken headers. An attacker can expose sensitive tokens to a third party by convincing a user to click on a malicious link when running an old version of the jupyter-server component. Exploiting this vulnerability allows potential authentication and CSRF tokens to leak.

How to fix Information Exposure?

Upgrade jupyterlab to version 3.6.7, 4.0.11 or higher.

[,3.6.7) [4.0.0,4.0.11)
Go back to all versions of this package