CVE-2024-22421

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.

• CWE-23
• CWE-200

• https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6Patch
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/Mailing List, Third Party Advisory
• https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6Patch
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/Mailing List, Third Party Advisory

Published

Jan 19, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22416pyLoad is a free and open-source Download Manager written in…8.8
• CVE-2024-22417Whoogle Search is a self-hosted metasearch engine. In versio…6.1
• CVE-2024-22418Group-Office is an enterprise CRM and groupware tool. Affect…5.4
• CVE-2024-22419Vyper is a Pythonic Smart Contract Language for the Ethereum…9.8
• CVE-2024-2242The Contact Form 7 plugin for WordPress is vulnerable to Ref…6.1
• CVE-2024-22420JupyterLab is an extensible environment for interactive and …6.1
• CVE-2024-22422AnythingLLM is an application that turns any document, resou…7.5
• CVE-2024-22423yt-dlp is a youtube-dl fork with additional features and fix…9.8
• CVE-2024-22424Argo CD is a declarative, GitOps continuous delivery tool fo…8.3
• CVE-2024-22425Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contai…9.8
• CVE-2024-22426Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contai…9.8
• CVE-2024-22428 Dell iDRAC Service Module, versions 5.2.0.0 and prior, cont…7.8