cve.bz

CVE-2021-32797

9.6 criticalEPSS 2.7%

Critical (9.6) in jupyter jupyterlab. EPSS 2.7% chance of exploitation in the next 30 days. Fixed in jupyterlab 1.2.21, 2.2.10, 2.3.2.

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.

Severity

CVSS 3.1

9.6 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS
2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4952-p58q-6crxPyPIjupyterlab<1.2.211.2.21
GHSA-4952-p58q-6crxPyPIjupyterlab>=2.0.0a0 <2.2.102.2.10
GHSA-4952-p58q-6crxPyPIjupyterlab>=2.3.0a0 <2.3.22.3.2
GHSA-4952-p58q-6crxPyPIjupyterlab>=3.0.0a0 <3.0.173.0.17
GHSA-4952-p58q-6crxPyPIjupyterlab>=3.1.0a0 <3.1.43.1.4
GHSA-4952-p58q-6crxPyPInotebook<5.7.115.7.11
GHSA-4952-p58q-6crxPyPInotebook>=6.0.0 <6.4.16.4.1
PYSEC-2021-130PyPIjupyterlab<1.2.21
>=2 <2.2.10
>=2.3 <2.3.2
>=3 <3.0.17
>=3.1 <3.1.4		1.2.21, 2.2.10, 2.3.2, 3.0.17, 3.1.4
PYSEC-2026-688PyPInotebook<5.7.11
>=6.0.0 <6.4.1		5.7.11, 6.4.1

References

Check your stackJSON