Threats tagged 'brew-jupyterlab-cve-2026-59924'

A path traversal vulnerability exists in the mistune library's Include directive when processing markdown files using md.read(). This flaw allows crafted include paths to access files outside the intended markdown directory. The issue arises because the resolved file path is not verified to remain within a trusted base directory, enabling traversal sequences like ../ to escape the intended folder. Applications that process untrusted markdown with this directive enabled may inadvertently expose sensitive files. The vulnerability affects jupyterlab versions from 1.2.0 up to but not including 4.6.1. A fix is available in version 4.6.1.