{"answers":{"affected":"2 open source packages ship an affected version, including jupyterlite-core.","exploited":"There is no known exploitation of GHSA-gj55-2xf9-67rq in the wild and no public exploit code.","fix":"Upgrade jupyterlite-core to 0.4.1 or later.","what":"GHSA-gj55-2xf9-67rq is a cross-site scripting vulnerability in jupyterlite-core, published on 6 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-gj55-2xf9-67rq and fix it if it is affected.\n\nWhat it is: GHSA-gj55-2xf9-67rq is a cross-site scripting vulnerability in jupyterlite-core, published on 6 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-gj55-2xf9-67rq in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- jupyterlite-core (PyPI): affected all versions; fixed in 0.4.1\n- jupyterlite-core (PyPI): affected all versions; fixed in 0.4.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-gj55-2xf9-67rq/ (Markdown: https://insights.sbomify.com/GHSA-gj55-2xf9-67rq/index.md)","id":"GHSA-gj55-2xf9-67rq","markdown":"https://insights.sbomify.com/GHSA-gj55-2xf9-67rq/index.md","name":"GHSA-gj55-2xf9-67rq","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"JupyterLite web app","requires_auth":"none","summary":"Attackers can execute arbitrary code and access data via DOM clobbering in JupyterLite when users open malicious notebooks or markdown files.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nThe vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.\n\nA malicious user can access any data accessible from JupyterLite and perform arbitrary actions in JupyterLite environment.\n\n### Patches\n\nJupyterLite 0.4.1 was patched.\n\n### Workarounds\n\nThere is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are:\n- `@jupyterlab/mathjax-extension:plugin` - users will loose ability to preview mathematical equations \n- `@jupyterlab/markdownviewer-extension:plugin` - users will loose ability to open Markdown previews\n- `@jupyterlab/mathjax2-extension:plugin` (if installed with optional `jupyterlab-mathjax2` package) - an older version of the mathjax plugin for JupyterLab 4.x\n\nTo disable these extensions populate the `disabledExtensions` key in `jupyter-config-data` stanza of `jupyter-lite.json` as documented on https://jupyterlite.readthedocs.io/en/stable/howto/configure/config_files.html#jupyter-lite-json\n\n```json\n{\n  \"jupyter-lite-schema-version\": 0,\n  \"jupyter-config-data\": {\n    \"appName\": \"My JupyterLite App\",\n    \"disabledExtensions\": [\n      \"@jupyterlab/markdownviewer-extension:plugin\",\n      \"@jupyterlab/mathjax-extension:plugin\",\n      \"@jupyterlab/mathjax2-extension:plugin\"\n    ]\n  }\n}\n```\n\nTo confirm that the plugins were disabled manual inspection of the built page is required.\n\n### References\n\nUpstream advisory: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2\n\n### Notes\n\nThis change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (`allowNamedProperties`).","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"HTML injection in JupyterLite leading to DOM Clobbering","id":"GHSA-gj55-2xf9-67rq","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"xss","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["0.4.1"],"introduced":["0"],"last_affected":[],"package":"jupyterlite-core","purl":null,"source":"GHSA-gj55-2xf9-67rq"},{"ecosystem":"PyPI","fixed":["0.4.1"],"introduced":["0"],"last_affected":[],"package":"jupyterlite-core","purl":"pkg:pypi/jupyterlite-core","source":"GHSA-gj55-2xf9-67rq"}],"products":null,"published":"2024-09-06","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can execute arbitrary code and access data via DOM clobbering in JupyterLite when users open malicious notebooks or markdown files.","url":"https://insights.sbomify.com/GHSA-gj55-2xf9-67rq/"}