CVE-2021-32797: jupyterlab

csirt@kutim:~/threat-intel/cve/CVE-2021-32797

CVSS 9.6 · Critical EPSS 2,7%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada jupyterlab. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.

Rincian

Terbit di NVD: 9 Agustus 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 2,7% peluang dieksploitasi; lebih tinggi dari 85,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jupyter	jupyterlab	Semua versi sebelum 1.2.21
jupyter	jupyterlab	Versi 2.0.0 hingga sebelum 2.2.10
jupyter	jupyterlab	Versi 2.3.0 hingga sebelum 2.3.2
jupyter	jupyterlab	Versi 3.0.0 hingga sebelum 3.0.17
jupyter	jupyterlab	Versi 3.1.0 hingga sebelum 3.1.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed exploit · advisory pihak ketiga
https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.