Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2021-32797

crítica

CVE-2021-32797

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

Publicada Modificada CWE 79
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GHSA6.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Bitnami9.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según GHSA (media).

Descripción

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
bitnami::Bitnami Vulnerability Databasejupyterlab1.2.21, 2.2.10, 2.3.2, 3.0.17, 3.1.4
pip::GitHub Security Advisory pipjupyterlab, notebook1.2.21, 2.2.10, 2.3.2, 3.0.17, 3.1.4 y 1 más
Mostrar las 3 entradas de 2 fuentes
FuentePaqueteCorregido en
bitnami::Bitnami Vulnerability Databasejupyterlab1.2.21, 2.2.10, 2.3.2, 3.0.17, 3.1.4
pip::GitHub Security Advisory pipjupyterlab1.2.21, 2.2.10, 2.3.2, 3.0.17, 3.1.4
pip::GitHub Security Advisory pipnotebook5.7.11, 6.4.1

Referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.