What’s Vulnerable › Vulnerabilities

CVE-2024-22421: Potential authentication and CSRF tokens leak in JupyterLab

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-19 · updated 2026-06-17
• Weakness: CWE-23

Description

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.

Affected products

• Fedoraproject Fedora: 39
• jupyterlab: before 3.6.7; from 4.0.0 before 4.0.11 — fixed in 3.6.7, 4.0.11
• jupyter notebook: from 7.0.0 before 7.0.7 — fixed in 7.0.7

How to fix

Upgrade to a fixed version: jupyterlab 3.6.7, 4.0.11; jupyter notebook 7.0.7. Check the vendor advisory for mitigations.

References

• https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/
• https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/

Get alerted when CVE-2024-22421 or the next vulnerability affects your stack