GHSA-gj55-2xf9-67rq: Jupyterlite core HTML Injection Vulnerability
MODERATEGHSA-gj55-2xf9-67rq is a MODERATE (CVSS 8.1) html injection vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Jupyterlite core libraries in the PyPI ecosystem. The issue involves html injection in jupyterlite leading to dom clobbering. Remediation is available by upgrading affected packages to version 0.4.1.
GHSA-gj55-2xf9-67rq at a Glance
Security Impact
CVSS: 8.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
How to Fix GHSA-gj55-2xf9-67rq
To remediate this vulnerability, upgrade all affected Jupyterlite core dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install jupyterlite-core>=0.4.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show jupyterlite-coreHow to Check if You Are Affected
To determine whether your Python environment is affected by GHSA-gj55-2xf9-67rq, inspect your installed packages using pip:
pip show jupyterlite-coreAnalyze the terminal output to locate any version of Jupyterlite core in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.4.1), your application is affected.
Note: The pip show jupyterlite-core command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Jupyterlite core, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-gj55-2xf9-67rq Affected Jupyterlite core Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
jupyterlite-core
|
PyPI |
< 0.4.1
|
0.4.1
|
References
Frequently Asked Questions
What is GHSA-gj55-2xf9-67rq?
Which Jupyterlite core versions are affected?
What version fixes GHSA-gj55-2xf9-67rq?
Is jupyterlite-core affected?
What is the CVSS score of GHSA-gj55-2xf9-67rq?
What CWE is associated with GHSA-gj55-2xf9-67rq?
How can I check PyPI dependencies for GHSA-gj55-2xf9-67rq?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-gj55-2xf9-67rq",
"modified" : "2024-11-18T16:27:10Z",
"published" : "2024-09-06T19:51:19Z",
"aliases" : [ ],
"summary" : "HTML injection in JupyterLite leading to DOM Clobbering",
"details" : "### Impact\n\nThe vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.\n\nA malicious user can access any data accessible from JupyterLite and perform arbitrary actions in JupyterLite environment.\n\n### Patches\n\nJupyterLite 0.4.1 was patched.\n\n### Workarounds\n\nThere is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are:\n- `@jupyterlab/mathjax-extension:plugin` - users will loose ability to preview mathematical equations \n- `@jupyterlab/markdownviewer-extension:plugin` - users will loose ability to open Markdown previews\n- `@jupyterlab/mathjax2-extension:plugin` (if installed with optional `jupyterlab-mathjax2` package) - an older version of the mathjax plugin for JupyterLab 4.x\n\nTo disable these extensions populate the `disabledExtensions` key in `jupyter-config-data` stanza of `jupyter-lite.json` as documented on https://jupyterlite.readthedocs.io/en/stable/howto/configure/config_files.html#jupyter-lite-json\n\n```json\n{\n \"jupyter-lite-schema-version\": 0,\n \"jupyter-config-data\": {\n \"appName\": \"My JupyterLite App\",\n \"disabledExtensions\": [\n \"@jupyterlab/markdownviewer-extension:plugin\",\n \"@jupyterlab/mathjax-extension:plugin\",\n \"@jupyterlab/mathjax2-extension:plugin\"\n ]\n }\n}\n```\n\nTo confirm that the plugins were disabled manual inspection of the built page is required.\n\n### References\n\nUpstream advisory: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2\n\n### Notes\n\nThis change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (`allowNamedProperties`).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "jupyterlite-core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.4.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2"
}, {
"type" : "WEB",
"url" : "https://github.com/jupyterlite/jupyterlite/security/advisories/GHSA-gj55-2xf9-67rq"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/jupyterlite/jupyterlite"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-09-06T19:51:19Z",
"nvd_published_at" : null
}
}