PT-2024-30672 · Unknown+1 · Jupyter Notebook+5

Krassowski · Published 2024-08-28 · Updated 2025-12-08 · CVE-2024-43805

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 3.6.8 JupyterLab versions prior to 4.2.5 Jupyter Notebook versions prior to 7.2.2

Description This issue depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.

Recommendations To resolve the issue, upgrade to JupyterLab version 3.6.8, 4.2.5 or later, or Jupyter Notebook version 7.2.2 or later. As a temporary workaround, consider disabling the following plugins:

• @jupyterlab/mathjax-extension:plugin to prevent previewing mathematical equations
• @jupyterlab/markdownviewer-extension:plugin to prevent opening Markdown previews
• @jupyterlab/mathjax2-extension:plugin (if installed) to prevent using an older version of the mathjax plugin for JupyterLab 4.x To disable these extensions, run the following commands in bash: jupyter labextension disable @jupyterlab/markdownviewer-extension:plugin jupyter labextension disable @jupyterlab/mathjax-extension:plugin jupyter labextension disable @jupyterlab/mathjax2-extension:plugin

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2025-14780

ALT-PU-2025-8028

BIT-JUPYTER-BASE-NOTEBOOK-2024-43805

BIT-JUPYTER-NOTEBOOK-2024-43805

BIT-JUPYTERLAB-2024-43805

CVE-2024-43805

GHSA-9Q39-RMJ3-P4R2

OPENSUSE-SU-2024:0352-1

Affected Products

@Jupyterlab/Markdownviewer-Extension

@Jupyterlab/Mathjax-Extension

@Jupyterlab/Mathjax2-Extension

Alt Linux

Jupyter Notebook

Jupyterlab

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43805.json · Exploit
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9q39-rmj3-p4r2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43805 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43805 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-43805 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyter-notebook-2024-43805 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43805 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43805 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-43805 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43805 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyter-base-notebook-2024-43805 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyterlab-2024-43805 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0352-1 · Vendor Advisory
• https://github.com/jupyterlab/jupyterlab · Note