high7.6

CVE-2024-43805

HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

Impact

### Impact The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. ### Patches JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2 were patched. ### Workarounds There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are: - `@jupyterlab/mathjax-extension:plugin` - users will loose ability to preview mathematical equations - `@jupyterlab/markdownviewer-extension:plugin` - users will loose ability to open Markdown previews - `@jupyterlab/mathjax2-extension:plugin` (if installed with optional `jupyterlab-mathjax2` package) - an older version of the mathjax plugin for JupyterLab 4.x To disable these extensions run: ```bash jupyter labextension disable @jupyterlab/markdownviewer-extension:plugin jupyter labextension disable @jupyterlab/mathjax-extension:plugin jupyter labextension disable @jupyterlab/mathjax2-extension:plugin ``` To confirm that the plugins were disabled run: ```bash jupyter labextension list ``` ### References None ### Notes This change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (`allowNamedProperties`).

Affected packages

Ecosystem	Package	Affected	Fixed in
pip	`jupyterlab`	<= 3.6.7	3.6.8
pip	`notebook`	>= 7.0.0, <= 7.2.1	7.2.2

Affected products

Vendor	Product	Affected versions
Jupyter	Jupyterlab	before 3.6.8 from 4.0.0 before 4.2.5
Jupyter	Notebook	from 7.0.0 before 7.2.2

Weakness classification

CWE-79