JupyterLab vulnerable to potential authentication and CSRF tokens leak

GHSA-44cc-43rp-5947 · BIT-jupyter-base-notebook-2024-22421 · BIT-jupyter-notebook-2024-22421 · BIT-jupyterlab-2024-22421 · CVE-2024-22421 · PYSEC-2026-1706 · PYSEC-2026-2534 · 갱신 2026. 9. 10.

생태계	패키지	수정 버전
PyPI	jupyterlab	4.0.113.6.7
PyPI	notebook	7.0.7

Impact

Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version.

Patches

JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched.

Workarounds

No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.

References

Vulnerability reported by user @davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

JupyterLab vulnerable to potential authentication and CSRF tokens leak

JupyterLab vulnerable to potential authentication and CSRF tokens leak

영향 받는 패키지

원문

Impact

Patches

Workarounds

References

출처