GHSA-pppj-hq3g-57pj: JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
JupyterLab 4.5+ allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor.
Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructions that run as code inside JupyterLab when imported, instead of only changing a display preference.
Because importing a settings file appears harmless, a user could import a file shared by another party without realizing it could do more. On multi-tenant file systems without proper permission control, another user could plant a malicious overrides.json.
CVE assignment pending, GitHub CNA is experiencing severe backlog
References
- github.com/advisories/GHSA-pppj-hq3g-57pj
- github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
- github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
- github.com/jupyterlab/jupyterlab/pull/19184
- github.com/jupyterlab/jupyterlab/pull/19185
- github.com/jupyterlab/jupyterlab/pull/19186
- github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
- github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
- github.com/jupyterlab/jupyterlab/security/advisories/GHSA-pppj-hq3g-57pj
Code Behaviors & Features
Detect and mitigate GHSA-pppj-hq3g-57pj with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →