GHSA-gx64-gj6p-pc4c
ADVISORY - githubSummary
JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
Impact
This vulnerability allows for arbitrary code execution.
Patches
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Workarounds
Disable the image viewer plugin:
jupyter labextension disable @jupyterlab/imageviewer-extension:plugin
Confirm with:
jupyter labextension list
Common Weakness Enumeration (CWE)
ADVISORY - github
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
GitHub
CREATED
UPDATED
ADVISORY IDGHSA-gx64-gj6p-pc4c
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)