7.6

CVE-2024-43805: jupyter jupyterlab Cross-site Scripting

CVSS: 7.6v3.1HighAnalyzed
AliasesopenSUSE-SU-2024:0352-1GHSA-9q39-rmj3-p4r2BIT-jupyter-base-notebook-2024-43805
Published 28-08-2024Last modified 28-08-2024
Open JSON

Vulnerability summary

CVE-2024-43805 is a high (CVSS 7.6) Cross-site Scripting vulnerability in jupyter jupyterlab. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.5% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.6/10
010
High · v3.1 (CVE.org)
EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 28-08-2024
    PublishedVulnerability first disclosed.
  2. 28-08-2024
    Last modifiedVulnerability information updated.

Description

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2 have been patched to resolve this issue. Users are advised to upgrade. There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are: 1. `@jupyterlab/mathjax-extension:plugin` - users will loose ability to preview mathematical equations. 2. `@jupyterlab/markdownviewer-extension:plugin` - users will loose ability to open Markdown previews. 3. `@jupyterlab/mathjax2-extension:plugin` (if installed with optional `jupyterlab-mathjax2` package) - an older version of the mathjax plugin for JupyterLab 4.x. To disable these extensions run: ```jupyter labextension disable @jupyterlab/markdownviewer-extension:plugin && jupyter labextension disable @jupyterlab/mathjax-extension:plugin && jupyter labextension disable @jupyterlab/mathjax2-extension:plugin ``` in bash.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

0.00 pp

From 0.40% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Jupyter2 products
Opensuse2 products
  • python-jupyterlab&distro=openSUSE Leap 15.5< 2.2.10-bp156.3.3.1
  • python-jupyterlab&distro=openSUSE Leap 15.6< 2.2.10-bp156.3.3.1
PyPI2 products
  • jupyterlab< 3.6.8 | ≥ 4.0.0, < 4.2.5
  • notebook≥ 7.0.0, < 7.2.2
Suse2 products
  • python-jupyterlab&distro=SUSE Package Hub 15 SP5< 2.2.10-bp156.3.3.1
  • python-jupyterlab&distro=SUSE Package Hub 15 SP6< 2.2.10-bp156.3.3.1
Debian1 product
  • jupyterlab< 4.0.11+ds1+~cs11.25.27-3
Jupyterlab1 product
  • jupyterlabnotebook: >= 7.0.0, <= 7.2.2 | jupyterlab: >= 4.0.0, < 4.2.5 | jupyterlab: < 3.6.8
Ubuntu1 product
  • jupyterlabAll versions (No fix recorded)

7 vendors · 11 products

References

13 links
Show all 13 references