GHSA-gx64-gj6p-pc4c: JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab’s image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
References
- github.com/advisories/GHSA-gx64-gj6p-pc4c
- github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
- github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
- github.com/jupyterlab/jupyterlab/pull/19184
- github.com/jupyterlab/jupyterlab/pull/19185
- github.com/jupyterlab/jupyterlab/pull/19186
- github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
- github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
- github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c
Code Behaviors & Features
Detect and mitigate GHSA-gx64-gj6p-pc4c with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →