atacworks (>=0.3.0 <=0.3.3), chronix2grid (>=0.1.0rc1 <=1.0.2) +13 more potentially affected by CVE-2021-32797 via jupyterlab (>=2.0.0 <=2.2.1)

jupyterlab PYPI version =2.0.0, =0.3.0, =0.1.0rc1, =0.8.14, =4.0.0, =0.1.0, =0.3.2, =0.8.22, =0.1.6, =0.8.25, =0.0.4, =0.3.0, =0.2.0, =0.0.4, =0.0.14 Source cves: CVE-2021-32797 Source advisory: OSV:PYSEC-2021-130...

corradin-opioid-project (=0.1.0), eflow (=0.1.3) +7 more potentially affected by CVE-2021-32797 via jupyterlab (>=0.31.1 <=1.1.4)

jupyterlab PYPI version =0.31.1, =0.9.0, =0.1.1, =0.2.41, =0.2.90 Source cves: CVE-2021-32797 Source advisory: OSV:PYSEC-2021-130...

PYSEC-2021-130

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

cadlabs-ethereum-economic-model (=0.0.2a0), dimbridge (=0.2.0) +4 more potentially affected by CVE-2021-32797 via jupyterlab (>=3.0.0 <=3.0.16)

jupyterlab PYPI version =3.0.0, =0.3.8, =0.5.10, =0.1.4, =0.1.5 Source cves: CVE-2021-32797 Source advisory: OSV:PYSEC-2021-130...

PYSEC-2021-130

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

CVE-2021-32797

CVE-2021-32797 (JupyterLab) is a remote code execution vulnerability where untrusted notebooks can run code on load due to lack of sanitization of the HTML form action attribute. Exploitation requires the user to open a specially crafted notebook, i.e., user action is required. Public sources in ...

CVE-2021-32797

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

CVE-2021-32797 JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

PT-2021-19938

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 1.2.21 JupyterLab versions prior to 2.2.10 JupyterLab versions prior to 2.3.2 JupyterLab versions prior to 3.0.17 JupyterLab versions prior to 3.1.4 Description In affected versions, an untrusted notebook can execu...

@antv/chart-linter (>=1.1.5 <=1.1.6), @dljsbook/data (>=0.3.2 <=0.6.1) +50 more potentially affected by CVE-2019-10806 via vega-util (>=1.10.0 <=1.12.2)

vega-util NPM version =1.10.0, =1.1.5, =0.3.2, =0.6.0, =0.0.4, =1.0.0, =0.8.0, =1.0.0-alpha.4, =0.0.0-placeholder, =0.2.4, =0.4.3-dev9, =1.0.0, =1.4.0, =5.0.0, =6.0.2-alpha.0 and more Source cves: CVE-2019-10806 Source advisory: OSV:GHSA-6HWH-RQWF-CXXR...

@candela/stats (>=0.20.0 <=0.21.0), @candela/vega (>=0.20.0 <=0.23.0) +77 more potentially affected by CVE-2020-26296 via vega (>=1.5.4 <=5.17.2)

vega NPM version =1.5.4, =0.20.0, =0.20.0, =0.3.0, =0.6.0, =0.8.0, =1.0.0-alpha.13, =0.0.1, =1.0.0, =1.4.0, =1.0.3, =3.2.4 and more Source cves: CVE-2020-26296 Source advisory: OSV:GHSA-R2QC-W64X-6J54...

CVE-2020-26275

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

PYSEC-2020-50

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

CVE-2020-26275 Open redirect vulnerability

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

chronix2grid (>=0.1.0rc1 <=1.0.2), jupyterlab (>=3.0.0b2 <=3.0.0rc13) +10 more potentially affected by CVE-2020-26232 via jupyter-server (>=0.0.5 <=1.0.11)

jupyter-server PYPI version =0.0.5, =0.1.0rc1, =3.0.0b2, =2.0.0b1, =0.2.0, =0.2.1, =0.0.11, =0.0.1, =0.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0a4 Source cves: CVE-2020-26232 Source advisory: OSV:GHSA-GRFJ-WJV9-4F9V...

Jupyter Unauthorized Access Vulnerability in JupyterLab

JupyterLab is a web-based integrated development environment . Jupyter JupyterLab suffers from an unauthorized access vulnerability that can be exploited by an attacker to execute arbitrary commands and gain server privileges...