CVE-2021-32797

Description

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.

How to fix CVE-2021-32797

To remediate CVE-2021-32797, upgrade the affected package to a fixed version below.

• —upgrade to 1.2.21 or later
• —upgrade to 1.2.21 or later
• —upgrade to 504825938c0abfa2fb8ff8d529308830a5ae42ed or later
• —upgrade to 5.7.11 or later

Is CVE-2021-32797 being exploited?

Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 1.2.21, >= 2.0.0, < 2.2.10, >= 2.3.0, < 2.3.2, >= 3.0.0, < 3.0.17, >= 3.1.0, < 3.1.4
• from 0, < 1.2.21
• from 0, < 504825938c0abfa2fb8ff8d529308830a5ae42ed | from 0, < 1.2.21, >= 2, < 2.2.10, >= 2.3, < 2.3.2, >= 3, < 3.0.17, >= 3.1, < 3.1.4
• from 0, < 5.7.11

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-32797
• WEBgithub.com/google/security-research/security/advisories/GHSA-c469-p3jp-2vhx
• WEBgithub.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
• WEBgithub.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx