Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-gj55-2xf9-67rq
No affected components available
Impact
The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.
A malicious user can access any data accessible from JupyterLite and perform arbitrary actions in JupyterLite environment.
Patches
JupyterLite 0.4.1 was patched.
Workarounds
There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are:
@jupyterlab/mathjax-extension:plugin- users will loose ability to preview mathematical equations@jupyterlab/markdownviewer-extension:plugin- users will loose ability to open Markdown previews@jupyterlab/mathjax2-extension:plugin(if installed with optionaljupyterlab-mathjax2package) - an older version of the mathjax plugin for JupyterLab 4.x
To disable these extensions populate the disabledExtensions key in jupyter-config-data stanza of jupyter-lite.json as documented on https://jupyterlite.readthedocs.io/en/stable/howto/configure/config_files.html#jupyter-lite-json
{
"jupyter-lite-schema-version": 0,
"jupyter-config-data": {
"appName": "My JupyterLite App",
"disabledExtensions": [
"@jupyterlab/markdownviewer-extension:plugin",
"@jupyterlab/mathjax-extension:plugin",
"@jupyterlab/mathjax2-extension:plugin"
]
}
}
To confirm that the plugins were disabled manual inspection of the built page is required.
References
Upstream advisory: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2
Notes
This change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (allowNamedProperties).
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. The attacker needs the user to perform some action, like clicking a link. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data.
Exploitation activity has been observed. Apply available patches or mitigations urgently.
Probability that this vulnerability will be exploited in the wild within the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard