VDB
CVE-2021-32797
CVE-2021-32797
PUBLISHED
CVSS 9.600000381469727 CRITICAL
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.
EPSS 2.66% · 85.2th percentile
Risk Scores
CVSS 3.1
9.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score
2.66%
85.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | jupyterlab | 0, 2.0.0, 2.3.0 |
| Bitnami | jupyterlab | 0, 2.0.0, 2.3.0 |
Timeline
- Aug 9, 2021 CVE Published
- Aug 10, 2021 EPSS Score
- Oct 8, 2021 EPSS Score
- Dec 6, 2021 EPSS Score
- Feb 3, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Apr 3, 2022 EPSS Score
- Jul 31, 2022 EPSS Score
- Sep 28, 2022 EPSS Score
- Nov 26, 2022 EPSS Score
- Jan 24, 2023 EPSS Score