---

CVE-2021-32797 - log back

CVE-2021-32797 edited at 09 Aug 2021 22:39:31
Severity	- Unknown + High
Remote	- Unknown + Remote
Type	- Unknown + Cross-site scripting
Description	+ In JupyterLab before version 3.1.4, untrusted notebooks can execute code on load. In particular JupyterLab doesn't sanitize the action attribute of the HTML <form> element. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.
References	+ https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx + https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
Notes

CVE-2021-32797 created at 09 Aug 2021 22:37:37