Vulnerability	Vulnerable Version
L Time-of-check Time-of-use (TOCTOU) Race Condition Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the `CommandLinker` trust mechanism, where a command-link click triggers a trust dialog and, upon user approval, executes the associated trust command without verifying that the DOM boundary being trusted corresponds to the widget that initiated the trust request. An attacker who can embed malicious content in a notebook or Markdown document can cause the trust action to be applied to an unintended widget, effectively bypassing the trust boundary and elevating the privilege of untrusted content. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade `jupyterlite-core` to version 0.8.4 or higher.	[0.7.5,0.8.4)

Time-of-check Time-of-use (TOCTOU) Race Condition

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the CommandLinker trust mechanism, where a command-link click triggers a trust dialog and, upon user approval, executes the associated trust command without verifying that the DOM boundary being trusted corresponds to the widget that initiated the trust request. An attacker who can embed malicious content in a notebook or Markdown document can cause the trust action to be applied to an unintended widget, effectively bypassing the trust boundary and elevating the privilege of untrusted content.

How to fix Time-of-check Time-of-use (TOCTOU) Race Condition?

Upgrade jupyterlite-core to version 0.8.4 or higher.

[0.7.5,0.8.4)

Go back to all versions of this package