PT-2024-19406 · Unknown · Jupyterlab-Lsp+3

Bary Levy · CVE-2024-22415 · Published 2024-01-18 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions jupyter-lsp versions prior to 2.2.2

Description The issue affects installations of jupyter-lsp running in environments without configured file system access control and with jupyter-server instances exposed to non-trusted networks, allowing unauthorized access and modification of the file system beyond the jupyter root directory.

Recommendations For versions prior to 2.2.2, upgrade to version 2.2.2 to resolve the issue. As a temporary workaround for users unable to upgrade, consider uninstalling jupyter-lsp. Users of jupyterlab who do not use jupyterlab-lsp can uninstall jupyter-lsp as a mitigation measure.

Exploit

Fix

Path traversal

Missing Authentication

Relative Path Traversal

Improper Access Control

Weakness Enumeration

CWE-22

CWE-306

CWE-23

CWE-284

Related Identifiers

CVE-2024-22415

GHSA-4QHP-652W-C22X

OPENSUSE-SU-2024:13601-1

PYSEC-2026-1478

Affected Products

Jupyter-Lsp

Jupyter Server

Jupyterlab

Jupyterlab-Lsp

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22415.json · Exploit
• https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95 · Patch
• https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp-652w-c22x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22415 · Security Note
• https://osv.dev/vulnerability/GHSA-4qhp-652w-c22x · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1478 · Vendor Advisory
• https://github.com/jupyter-lsp/jupyterlab-lsp · Note
• https://github.com/jupyter-lsp/jupyterlab-lsp/releases/tag/v5.0.2 · Note
• https://pypi.org/project/jupyter-lsp · Note
• https://twitter.com/CVEnew/status/1748082314108612649 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1748130892252336422 · Twitter Post
• https://github.com/advisories/GHSA-4qhp-652w-c22x · Note