JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

GHSA-4952-p58q-6crx · BIT-jupyterlab-2021-32797 · CVE-2021-32797 · PYSEC-2021-130 · PYSEC-2026-688 · 갱신 2026. 7. 8.

해야 할 일

jupyterlab: 쓰는 버전대에 맞춰 1.2.21 / 2.2.10 / 2.3.2 / 3.0.17 / 3.1.4 이상, notebook: 쓰는 버전대에 맞춰 5.7.11 / 6.4.1 이상으로 올리세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	jupyterlab	1.2.212.2.102.3.23.0.173.1.4

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.

Patched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21.

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.

Credit: Guillaume Jeanne from Google

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> (GHSA-4952-p58q-6crx) · Sieve