CVE-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab
Attackers can execute arbitrary scripts via malicious Markdown files in JupyterLab, allowing data theft and actions as the victim.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-22420?
CVE-2024-22420 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 19 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.
Weakness: CWE-79
Which versions are affected by CVE-2024-22420?
9 open source packages ship an affected version, including jupyterlab, jupyter-base-notebook and jupyter-notebook. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
jupyterlab Bitnami | From 4.0.0 | 4.2.4 |
jupyterlab PyPI | From 4.0.0 | 4.0.11 |
jupyterlab PyPI | From 4.0.0 | 4.0.11 |
jupyterlab PyPI | From 4.0.0 | 4.0.11 |
jupyter-base-notebook Bitnami | From 7.0.0 | None |
jupyter-notebook Bitnami | From 7.0.0 | 7.0.7 |
3 more packages
notebook PyPI | From 7.0.0 | 7.0.7 |
notebook PyPI | From 7.0.0 | 7.0.7 |
notebook PyPI | From 7.0.0 | 7.0.7 |
Products include Fedoraproject Fedora, Jupyter Jupyterlab, Jupyter Notebook.
How do I fix CVE-2024-22420?
Upgrade jupyterlab to a fixed version for your release line: 4.2.4 or 4.0.11.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-22420 being exploited?
There is no known exploitation of CVE-2024-22420 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BIT-jupyter-base-notebook-2024-22420, BIT-jupyter-notebook-2024-22420, BIT-jupyterlab-2024-22420, DEBIAN-CVE-2024-22420, GHSA-4m77-cmpx-vjc4, OESA-2025-1239 and 4 more.