Arch Linux Security Advisory ASA-202108-10 ========================================== Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-32797 Package : jupyterlab Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2266 Summary ======= The package jupyterlab before version 3.1.4-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 3.1.4-1. # pacman -Syu "jupyterlab>=3.1.4-1" The problem has been fixed upstream in version 3.1.4. Workaround ========== None. Description =========== In JupyterLab before version 3.1.4, untrusted notebooks can execute code on load. In particular JupyterLab doesn't sanitize the action attribute of the HTML <form> element. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. Impact ====== An attacker could perform remote code execution using a maliciously crafted notebook file. References ========== https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-... https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d52930... https://security.archlinux.org/CVE-2021-32797