CVE-2024-22420

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.

• CWE-79
• CWE-79

• https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2dfPatch
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/Mailing List, Third Party Advisory
• https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2dfPatch
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/Mailing List, Third Party Advisory

Published

Jan 19, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22415jupyter-lsp is a coding assistance tool for JupyterLab (code…9.8
• CVE-2024-22416pyLoad is a free and open-source Download Manager written in…8.8
• CVE-2024-22417Whoogle Search is a self-hosted metasearch engine. In versio…6.1
• CVE-2024-22418Group-Office is an enterprise CRM and groupware tool. Affect…5.4
• CVE-2024-22419Vyper is a Pythonic Smart Contract Language for the Ethereum…9.8
• CVE-2024-2242The Contact Form 7 plugin for WordPress is vulnerable to Ref…6.1
• CVE-2024-22421JupyterLab is an extensible environment for interactive and …6.5
• CVE-2024-22422AnythingLLM is an application that turns any document, resou…7.5
• CVE-2024-22423yt-dlp is a youtube-dl fork with additional features and fix…9.8
• CVE-2024-22424Argo CD is a declarative, GitOps continuous delivery tool fo…8.3
• CVE-2024-22425Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contai…9.8
• CVE-2024-22426Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contai…9.8