PT-2024-19411 · Unknown+1 · Jupyterlab+1

Krassowski · Published 2024-01-19 · Updated 2025-03-07 · CVE-2024-22420

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 4.0.11

Description This issue depends on user interaction by opening a malicious Markdown file using JupyterLab's preview feature. A malicious user can access any data that the attacked user has access to and perform arbitrary requests acting as the attacked user.

Recommendations For versions prior to 4.0.11, upgrade to version 4.0.11 or later. As a temporary workaround for users unable to upgrade, disable the table of contents extension by running jupyter labextension disable @jupyterlab/toc-extension:registry in the terminal.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2024-12926

BIT-JUPYTER-BASE-NOTEBOOK-2024-22420

BIT-JUPYTER-NOTEBOOK-2024-22420

BIT-JUPYTERLAB-2024-22420

CVE-2024-22420

GHSA-4M77-CMPX-VJC4

OESA-2025-1239

OESA-2025-1240

OPENSUSE-SU-2024:13605-1

OPENSUSE-SU-2024:13606-1

Affected Products

Alt Linux

Jupyterlab

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22420.json · Exploit
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4 · Vendor Advisory
• https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2df · Patch
• https://osv.dev/vulnerability/GHSA-4m77-cmpx-vjc4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22420 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22420 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-22420 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyterlab-2024-22420 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1239 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyter-notebook-2024-22420 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyter-base-notebook-2024-22420 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22420 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1240 · Vendor Advisory
• https://github.com/jupyterlab/jupyterlab · Note