JupyterLab vulnerable to SXSS in Markdown Preview

🗓️ 19 Jan 2024 20:24:09Reported by GitHub Advisory DatabaseType

JupyterLab vulnerability to SXSS in Markdown Preview. Malicious notebook or Markdown file can access user data and perform arbitrary requests

Reporter	Title	Published	Views	Family All 30
Circl	CVE-2024-22420	15 Feb 202415:56	–	circl
CNNVD	JupyterLab Security Breach	19 Jan 202400:00	–	cnnvd
CVE	CVE-2024-22420	19 Jan 202420:49	–	cve
Cvelist	CVE-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab	19 Jan 202420:49	–	cvelist
Debian CVE	CVE-2024-22420	19 Jan 202420:49	–	debiancve
EUVD	EUVD-2024-0248	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 39 Update: jupyterlab-4.0.11-1.fc39	2 Feb 202401:15	–	fedora
Fedora	[SECURITY] Fedora 39 Update: python-notebook-7.0.7-1.fc39	2 Feb 202401:15	–	fedora
Tenable Nessus	Fedora 39 : jupyterlab / python-notebook (2024-1673c2696e)	2 Feb 202400:00	–	nessus
NVD	CVE-2024-22420	19 Jan 202421:15	–	nvd

Vulners

Node

jupyter notebookRange7.0.0–7.0.6pip

jupyterlab jupyterlabRange4.0.0–4.0.10pip

Source	Link
github	www.github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4
github	www.github.com/jupyterlab/jupyterlab/commit/dda0033cd49449572d077bbecd33b18d8d05f48a
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-22420
github	www.github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2df
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/
github	www.github.com/advisories/GHSA-4m77-cmpx-vjc4

10 Feb 2024 05:08Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.1 - 6.5

EPSS0.00343

SSVC