JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. In affected versions (>=3.3.0 <4.5.10 and >=4.6.0 <4.6.2), the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings are not properly validated before being inserted into style content. This improper validation enables a crafted settings file to contain instructions that execute as code rather than just changing display preferences. A user importing such a malicious file or an attacker placing it in a shared settings location can trigger execution of embedded code with the user's privileges, potentially reading/modifying notebooks and files and running code on the notebook server and connected kernels. The vulnerability is addressed in versions 4.5.10 and 4.6.2.

Exploitation of this vulnerability allows code execution in the context of the affected user, enabling reading and modification of notebooks and files, and execution of arbitrary code on the notebook server and connected kernels. This can lead to unauthorized access and control over user data and computational resources within JupyterLab environments.

A fix is available in JupyterLab versions 4.5.10 and 4.6.2. Users and administrators should upgrade affected installations to one of these versions or later to remediate this vulnerability. Until patched, users should avoid importing untrusted overrides.json settings files and restrict access to shared settings locations to trusted parties only.