Description
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jupyterlab jupyterlab
Default version status: unaffected
0 to < 4.5.9affected4.5.9unaffected
pkg:pypi/jupyterlabReferences
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vmhf-c436-hxj4 ↗
- https://github.com/jupyterlab/jupyterlab/commit/4e61e07d0a91145b53fbf96ac74b0387f6bc51f6 ↗
- https://github.com/jupyterlab/jupyterlab/commit/d5d961f6e10a6442dddbf94d9a976b3897055a12 ↗
- https://www.vulncheck.com/advisories/jupyterlab-before-stored-xss-via-extension-manager ↗