{"cve":"CVE-2021-32797","nvd":{"published":"2021-08-09T21:15:08.140","modified":"2026-06-17T03:53:38.983","status":"Modified","description":"JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-79"],"references":["https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed","https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx","https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed","https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx"],"products":["jupyter:jupyterlab"],"source":"nvd","synced_at":"2026-10-19T21:21:13.713336758+00:00"},"epss":{"cve":"CVE-2021-32797","score":0.0266,"percentile":0.85697,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4952-p58q-6crx","url":"https://osv.dev/vulnerability/GHSA-4952-p58q-6crx","summary":"JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>","modified":"2026-07-08T06:28:37.707191234Z","packages":[{"ecosystem":"PyPI","name":"jupyterlab","purl":"pkg:pypi/jupyterlab","ranges":["<1.2.21"],"fixed":["1.2.21"]},{"ecosystem":"PyPI","name":"jupyterlab","purl":"pkg:pypi/jupyterlab","ranges":[">=2.0.0a0 <2.2.10"],"fixed":["2.2.10"]},{"ecosystem":"PyPI","name":"jupyterlab","purl":"pkg:pypi/jupyterlab","ranges":[">=2.3.0a0 <2.3.2"],"fixed":["2.3.2"]},{"ecosystem":"PyPI","name":"jupyterlab","purl":"pkg:pypi/jupyterlab","ranges":[">=3.0.0a0 <3.0.17"],"fixed":["3.0.17"]},{"ecosystem":"PyPI","name":"jupyterlab","purl":"pkg:pypi/jupyterlab","ranges":[">=3.1.0a0 <3.1.4"],"fixed":["3.1.4"]},{"ecosystem":"PyPI","name":"notebook","purl":"pkg:pypi/notebook","ranges":["<5.7.11"],"fixed":["5.7.11"]},{"ecosystem":"PyPI","name":"notebook","purl":"pkg:pypi/notebook","ranges":[">=6.0.0 <6.4.1"],"fixed":["6.4.1"]}]},{"id":"PYSEC-2021-130","url":"https://osv.dev/vulnerability/PYSEC-2021-130","summary":"","modified":"2026-07-06T08:11:30.661358280Z","packages":[{"ecosystem":"PyPI","name":"jupyterlab","purl":"pkg:pypi/jupyterlab","ranges":["<1.2.21",">=2 <2.2.10",">=2.3 <2.3.2",">=3 <3.0.17",">=3.1 <3.1.4"],"fixed":["1.2.21","2.2.10","2.3.2","3.0.17","3.1.4"]}]},{"id":"PYSEC-2026-688","url":"https://osv.dev/vulnerability/PYSEC-2026-688","summary":"JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>","modified":"2026-07-06T08:11:30.661358280Z","packages":[{"ecosystem":"PyPI","name":"notebook","purl":"pkg:pypi/notebook","ranges":["<5.7.11",">=6.0.0 <6.4.1"],"fixed":["5.7.11","6.4.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}