[ASA-202108-10] jupyterlab: cross-site scripting

Arch Linux Security Advisory ASA-202108-10 ========================================== Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-32797 Package : jupyterlab Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2266 Summary ======= The package jupyterlab before...

CVE-2021-32797

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

CVE-2021-32797

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

Design/Logic Flaw

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

CVE-2021-32797

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

PYSEC-2021-130

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

PYSEC-2021-130

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

CVE-2021-32797

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

CVE-2021-32797 JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

CVE-2021-32797

CVE-2021-32797 (JupyterLab) is a remote code execution vulnerability where untrusted notebooks can run code on load due to lack of sanitization of the HTML form action attribute. Exploitation requires the user to open a specially crafted notebook, i.e., user action is required. Public sources in ...

PT-2021-19938

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 1.2.21 JupyterLab versions prior to 2.2.10 JupyterLab versions prior to 2.3.2 JupyterLab versions prior to 3.0.17 JupyterLab versions prior to 3.1.4 Description In affected versions, an untrusted notebook can execu...

CVE-2021-32797: Improper Neutralization of Input During Web Page Generation

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html . Using this it is possible to trigger the form...

CVE-2020-26275

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

PYSEC-2020-50

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

CVE-2020-26275 Open redirect vulnerability

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

CVE-2020-26275: URL Redirection to Untrusted Site

The Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a...

Jupyter Unauthorized Access Vulnerability in JupyterLab

JupyterLab is a web-based integrated development environment . Jupyter JupyterLab suffers from an unauthorized access vulnerability that can be exploited by an attacker to execute arbitrary commands and gain server privileges...