JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

🗓️ 23 Aug 2021 19:40:22Reported by GitHub Advisory DatabaseType

JupyterLab: XSS in html form action attribute, remote code executio

Reporter	Title	Published	Views	Family All 35
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	8 Jun 202321:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	22 Jun 202215:20	–	ibm
ArchLinux	[ASA-202108-10] jupyterlab: cross-site scripting	10 Aug 202100:00	–	archlinux
Circl	CVE-2021-32797	10 Aug 202100:36	–	circl
CNNVD	Jupyter Notebook 跨站脚本漏洞	9 Aug 202100:00	–	cnnvd
CVE	CVE-2021-32797	9 Aug 202120:45	–	cve
Cvelist	CVE-2021-32797 JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>	9 Aug 202120:45	–	cvelist
Debian CVE	CVE-2021-32797	9 Aug 202120:45	–	debiancve
EUVD	EUVD-2021-0107	7 Oct 202500:30	–	euvd
Mageia	Updated python-jupyterlab packages fix security vulnerability	27 Feb 202320:27	–	mageia

Vulners

Node

jupyterlab jupyterlabRange3.1.0a0–3.1.4pip

jupyterlab jupyterlabRange3.0.0a0–3.0.17pip

jupyterlab jupyterlabRange2.3.0a0–2.3.2pip

jupyterlab jupyterlabRange2.0.0a0–2.2.10pip

jupyter notebookRange6.0.0–6.4.1pip

jupyter notebookRange<5.7.11pip

Source	Link
github	www.github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-32797
github	www.github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
github	www.github.com/google/security-research/security/advisories/GHSA-c469-p3jp-2vhx
github	www.github.com/pypa/advisory-database/tree/main/vulns/jupyterlab/PYSEC-2021-130.yaml
github	www.github.com/advisories/GHSA-4952-p58q-6crx

18 Nov 2024 16:26Current

1Low risk

Vulners AI Score1

CVSS 26.8

CVSS 3.17.4 - 9.6

EPSS0.0087