CyberRota Analysis
AI-GeneratedJupyterLab versions prior to 4.5.9 are vulnerable to a stored cross-site scripting (XSS) flaw in the Extension Manager, which does not properly validate URI protocols in package metadata URLs. This vulnerability allows attackers to create malicious PyPI packages containing javascript: URLs, enabling the execution of arbitrary JavaScript within the JupyterLab environment when users interact with the affected extensions. Organizations using JupyterLab should prioritize patching to mitigate the risk of exploitation and protect user data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.