PT-2021-23117 · Jupyterlab+1 · Nbdime-Jupyterlab+1
Vidartf
·
Published
2021-11-03
·
Updated
2021-11-08
·
CVE-2021-41134
CVSS v3.1
8.7
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
nbdime versions prior to 1.1.1
nbdime versions prior to 2.1.1
nbdime versions prior to 3.1.1
nbdime versions prior to 5.0.2
nbdime versions prior to 6.1.2
nbdime-jupyterlab versions prior to 1.0.1
nbdime-jupyterlab versions prior to 2.1.1
Description
A stored cross-site scripting (XSS) issue exists within the nbdime project. The issue arises from improper handling of user-controlled input, specifically when reading file names and paths from disk. The
diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook, nbdime appends .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function, allowing the frontend to render HTML tags and potentially malicious content.Recommendations
For nbdime versions prior to 1.1.1, update to version 1.1.1 or later.
For nbdime versions prior to 2.1.1, update to version 2.1.1 or later.
For nbdime versions prior to 3.1.1, update to version 3.1.1 or later.
For nbdime versions prior to 5.0.2, update to version 5.0.2 or later.
For nbdime versions prior to 6.1.2, update to version 6.1.2 or later.
For nbdime-jupyterlab versions prior to 1.0.1, update to version 1.0.1 or later.
For nbdime-jupyterlab versions prior to 2.1.1, update to version 2.1.1 or later.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nbdime
Nbdime-Jupyterlab