PT-2024-40302 · Jupyterlab+1 · @Jupyterlab/Mathjax-Extension+3

Published 2024-09-06 · Updated 2024-09-06

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions JupyterLite versions prior to 0.4.1

Description The issue depends on user interaction by opening a malicious notebook with Markdown cells or a Markdown file using the JupyterLab preview feature. A malicious user can access any data accessible from JupyterLite and perform arbitrary actions in the JupyterLite environment.

Recommendations For versions prior to 0.4.1, update to JupyterLite 0.4.1 to resolve the issue. As a temporary workaround, consider disabling the @jupyterlab/markdownviewer-extension:plugin, @jupyterlab/mathjax-extension:plugin, and @jupyterlab/mathjax2-extension:plugin (if installed) by populating the disabledExtensions key in the jupyter-config-data stanza of jupyter-lite.json. This will minimize the risk, but users will lose the ability to preview mathematical equations and open Markdown previews.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-GJ55-2XF9-67RQ

Affected Products

@Jupyterlab/Markdownviewer-Extension

@Jupyterlab/Mathjax-Extension

@Jupyterlab/Mathjax2-Extension

Jupyterlite

References · 4

• https://osv.dev/vulnerability/GHSA-gj55-2xf9-67rq · Vendor Advisory
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2 · Note
• https://github.com/jupyterlite/jupyterlite/security/advisories/GHSA-gj55-2xf9-67rq · Note
• https://github.com/jupyterlite/jupyterlite · Note