CVE-2024-39700

JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting of this file and re-apply your changes later. Users may wish to temporarily disable GitHub Actions while working on the upgrade. We recommend rebasing all open pull requests from untrusted users as actions may run using the version from the `main` branch at the time when the pull request was created. Users who are upgrading from template version prior to 4.3.0 may wish to leave out proposed changes to the release workflow for now as it requires additional configuration.

• CWE-94

• https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6Patch
• https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wgExploit, Vendor Advisory
• https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6Patch
• https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wgExploit, Vendor Advisory

Published

Jul 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39695Exiv2 is a command-line utility and C++ library for reading,…6.5
• CVE-2024-39696Evmos is a decentralized Ethereum Virtual Machine chain on t…8.1
• CVE-2024-39697phonenumber is a library for parsing, formatting and validat…8.6
• CVE-2024-39698electron-updater allows for automatic updates for Electron a…7.5
• CVE-2024-39699Directus is a real-time API and App dashboard for managing S…5
• CVE-2024-3970Server Side Request Forgery vulnerability has been discovere…7.5
• CVE-2024-39701Directus is a real-time API and App dashboard for managing S…7.7
• CVE-2024-39702In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the…5.9
• CVE-2024-39703In ThreatQuotient ThreatQ before 5.29.3, authenticated users…8.8
• CVE-2024-39704Soft Circle French-Bread Melty Blood: Actress Again: Current…9.8
• CVE-2024-39705NLTK through 3.8.1 allows remote code execution if untrusted…9.8
• CVE-2024-39707Insyde IHISI function 0x49 can restore factory defaults for …5.3