GHSA-gx64-gj6p-pc4c

ADVISORY - github

Summary

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Workarounds

Disable the image viewer plugin:

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

Confirm with:

jupyter labextension list

Common Weakness Enumeration (CWE)

ADVISORY - github

CWE-79⁠

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.