JupyterLab versions from 1.2.0 up to but not including 4.5.9 contain a stored cross-site scripting (XSS) vulnerability in the Extension Manager. A malicious PyPI package can include a 'javascript:' URL in its metadata, which JupyterLab renders as a clickable homepage link without validating the URL protocol. When a user clicks this link, attacker-controlled JavaScript executes in the JupyterLab origin. This vulnerability requires the Extension Manager to be enabled with the default PyPI source and the malicious package to appear in the user's extension list.
JupyterLab versions from 1.2.0 up to but not including 4.5.7_1 contain a vulnerability where the HTML sanitizer allowlists certain attributes that enable one-click execution of arbitrary JupyterLab commands from untrusted HTML content. This can lead to arbitrary code execution, file deletion, and denial of service by exhausting server resources. The vulnerability can be exploited by an attacker sharing a malicious notebook or Markdown file that contains deceptive buttons triggering commands upon user clicks. The issue is patched in version 4.5.7_1. No end-user workarounds exist, but downstream applications can disable the CommandLinker functionality. The patched versions also allow disabling the command linker via configuration.
JupyterLab versions prior to 4.5.7 have a vulnerability where the allow-list for extensions installable via the PyPI Extension Manager is not properly enforced. This allows authenticated users in multi-tenant or restricted environments to install arbitrary third-party extensions, potentially escalating privileges and compromising server security. The issue is patched in version 4.5.7. Workarounds include switching the extension manager to read-only mode.
A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with attacker-crafted elements. This vulnerability enables full account takeover via the Jupyter REST API, including reading and modifying files, executing arbitrary code, and shell access. Patches are available in Jupyter Notebook 7.5.6 and JupyterLab 4.5.7. Workarounds include disabling the help extension and toggling off the command linker functionality.
JupyterLab versions prior to 4.4.8 did not enforce the `noopener` attribute on links generated by LaTeX typesetters in Markdown files and cells. This omission could theoretically expose users of third-party LaTeX-rendering extensions that generate links with `target=_blank` to reverse tabnabbing attacks. However, official LaTeX typesetter extensions do not use `target=_blank`, so default installations are not impacted. The issue is fixed in JupyterLab 4.4.8, which enforces both `noopener` and `target=_blank` on such links to improve security and user experience.
CVE-2024-43805 is an HTML injection vulnerability in Jupyter Notebook and JupyterLab that enables DOM Clobbering. It requires user interaction by opening a malicious notebook with Markdown cells or a Markdown file using the JupyterLab preview feature. Exploitation allows an attacker to access any data available to the victim and perform arbitrary requests as the victim user. The issue is patched in JupyterLab 4.6.3 and later versions, and Jupyter Notebook 7.2.2 and later. No full workaround exists, but disabling certain plugins can reduce risk for those unable to update promptly.
The JupyterLab extension template prior to version 4.3.1 includes a GitHub Actions workflow file 'update-integration-tests.yml' that contains a remote code execution (RCE) vulnerability. This affects repositories created with the template using the 'test' option from versions 1.2.0 up to but not including 4.3.1. Extension authors hosting code on GitHub should upgrade to version 4.3.1 or later to mitigate this critical vulnerability. Users who modified the workflow file should accept overwriting it during upgrade and reapply changes afterward. Temporarily disabling GitHub Actions during the upgrade is recommended, as is rebasing pull requests from untrusted users to avoid running vulnerable workflows.
JupyterLab versions prior to 4.0.11 are vulnerable to a flaw that can expose users' Authorization and XSRF tokens if they click on a malicious link while running an older jupyter-server version. This vulnerability allows potential leakage of sensitive authentication tokens. The issue has been patched in JupyterLab 4.0.11 and later versions. Users are advised to upgrade jupyter-server to version 2.7.2 or newer to mitigate the risk, as no other workarounds are available.
JupyterLab versions from 4.0.0 up to but not including 4.0.11 are vulnerable to a stored cross-site scripting (SXSS) issue in the Markdown preview feature. This vulnerability requires user interaction by opening a malicious notebook or Markdown file. Exploitation allows an attacker to access data available to the user and perform arbitrary requests on their behalf. The issue is patched in version 4.0.11. As a workaround, users can disable the table of contents extension.
DuckDB versions from 2.3.0 up to but not including 2.4.0 implemented block-based encryption on the filesystem with several cryptographic weaknesses. These include fallback to an insecure random number generator (pcg32), potential removal of memory clearing calls by the compiler, downgrade attacks from GCM to CTR mode bypassing integrity checks, unchecked return values from OpenSSL's rand_bytes(), and exposure of cryptographic keys via memory leaks or compromised RNG state. Version 2.4.0 addresses these issues by disabling the insecure RNG fallback, using secure memory clearing primitives, enforcing explicit cipher specification, and checking return codes.
The httplib2 HTTP client library is vulnerable to a decompression bomb denial of service via unbounded gzip or deflate response handling. A malicious HTTP server can send a small compressed payload that decompresses into a very large memory allocation, causing the client to crash or be killed due to out-of-memory conditions. This affects any application using httplib2.Http().request() against untrusted endpoints. The vulnerability is fixed in version 0.20.27.
A vulnerability in pyasn1's univ.Real type causes excessive CPU and memory consumption when converting decoded REAL values with very large exponents to Python floats. This can lead to denial of service when applications decode untrusted ASN.1 data and then convert, print, or compare these REAL values. The issue affects pyasn1 versions from 0.2 up to but not including 0.20.27 and is fixed in version 0.20.27.
A quadratic time complexity vulnerability exists in the pyasn1 library's processing of OBJECT IDENTIFIER and RELATIVE-OID values during BER/CER/DER decoding and encoding. This flaw allows crafted ASN.1 data with many arcs to cause denial of service by consuming excessive CPU resources. The issue affects multiple codecs and is fixed in version 0.20.27. Applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, or Kerberos are at risk if using vulnerable versions.
A denial of service vulnerability exists in the pyasn1 BER/CER/DER decoder used by dstack, caused by unbounded long-form tag IDs. The decoder accumulates continuation octets without an upper limit, allowing crafted inputs to cause excessive CPU consumption. On Python 3.11 and later, oversized tag IDs can also trigger unhandled ValueErrors, potentially bypassing error handling. This affects decoding of untrusted BER/CER/DER inputs. The issue is fixed in version 0.20.27 by limiting tag ID length and improving error handling.
The pyasn1 library contains a denial of service vulnerability caused by unbounded recursion when decoding ASN.1 data with deeply nested indefinite-length SEQUENCE or SET tags. An attacker can supply a crafted payload that triggers recursive decoding calls without depth checks, leading to Python RecursionError or out-of-memory crashes. This affects services parsing untrusted ASN.1 data, such as LDAP, SNMP, Kerberos, or X.509 parsers. The vulnerability is fixed in pyasn1 version 0.20.13_1.
A Denial-of-Service (DoS) vulnerability exists in pyasn1 version 0.6.1 due to improper handling of malformed RELATIVE-OID values with excessive continuation octets in the decoder. This can lead to memory exhaustion and system hangs when decoding crafted ASN.1 data such as malicious X.509 certificates. The issue affects applications that parse ASN.1 structures, including LDAP servers, TLS/SSL endpoints, and OCSP responders. A fix is available in pyasn1 version 0.20.3_2.
An elevation of privilege vulnerability exists in Azure Identity Libraries and Microsoft Authentication Library as used in dstack versions >=0.9.1 and <0.18.3_1. This vulnerability allows a local attacker with limited privileges to gain elevated privileges. The issue has been assigned CVE-2024-35255 and has a medium severity rating with a CVSS score of 5.5. A fix is available in version 0.18.3_1.
A vulnerability in MessagePack for Python's Unpacker allows an out-of-bounds read leading to a crash (SEGV) if the Unpacker is reused after an error occurs. This can cause denial of service (DoS) when unpacking untrusted input repeatedly. The issue is fixed in version 4.0.1_1. Users should avoid reusing the same Unpacker after an error and instead create a new one or discard the streaming unpacker and stream after an error.
Two security vulnerabilities have been identified in the Python Pillow library affecting Red Hat Enterprise Linux 8.6. These include a native heap out-of-bounds write (CVE-2026-59197) and a memory disclosure or denial of service via a crafted McIdas AREA image (CVE-2026-54058). Red Hat has issued an important security advisory with updates to address these issues.