Critical severity · published Jul 16, 2024
CVE-2024-39700
JupyterLab extension template is a `copier` template for JupyterLab extensions
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting of this file and re-apply your changes later. Users may wish to temporarily disable GitHub Actions while working on the upgrade. We recommend rebasing all open pull requests from untrusted users as actions may run using the version from the `main` branch at the time when the pull request was created. Users who are upgrading from template version prior to 4.3.0 may wish to leave out proposed changes to the release workflow for now as it requires additional configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
Jupyterlab · Jupyter
before 4.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39700
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39700
Patch
https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6
Exploit
https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg
More from Jupyterlab
9.6
CVE-2026-42557
jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
9.6
CVE-2021-32797
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook
8.8
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
6.5
CVE-2024-22421
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture
6.1
CVE-2024-43805
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture