CVEFinder.io

CVE-2024-22421

⚠ī¸ high
🔍 Scan for this CVE
Summary

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes

Description

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.

CVSS Score
7.6
High
EPSS Score
0.1
Exploit Probability
Published Date
2024-01-19
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.3% of all 328,009 vulnerabilities in our database.

#100,584
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jan 20, 2024
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2024-11-21
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
CWE IDs (Weakness Types)
CWE-23 CWE-200

đŸ“Ļ Affected Products 4

Vendor Product Status Affected Versions
fedoraproject fedora Affected
v39
jupyter notebook Affected
≥ 7.0.0 < 7.0.7
jupyter jupyterlab Affected
< 3.6.7
jupyter jupyterlab Affected
≥ 4.0.0 < 4.0.11

🔗 References 3

https://github.com/jupyterlab/jupyterlab/commit/19bd...
Patch
https://github.com/jupyterlab/jupyterlab/security/ad...
Vendor Advisory
https://lists.fedoraproject.org/archives/list/packag...
Mailing List Third Party Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-42557 ⛔ critical 9.6 0.1 jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit... 2026-05-13
CVE-2026-42266 ⚠ī¸ high 8.8 0.0 JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit... 2026-05-13
CVE-2026-35093 ⚠ī¸ high 8.8 0.0 A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or ... 2026-04-01
CVE-2026-35094 ℹī¸ low 3.3 0.0 A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can expl... 2026-04-01
CVE-2025-59842 đŸ”ļ medium 4.3 0.1 jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit... 2025-09-26
CVE-2023-4134 đŸ”ļ medium 5.5 0.0 A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device... 2024-11-14
These CVEs affect the same products