CVE-2024-22420 - CVE House
Back to Database
Status published Medium CVE-2024-22420

Stored cross site scripting in Markdown Preview in JupyterLab

Vulnerability Description

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab version 4.0.11 has been patched. Users are advised to upgrade. Users unable to upgrade should disable the table of contents extension.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-22420

Credits & Attribution

No credits recorded in the NVD database.

References

More from jupyterlab

View All →
CVE-2025-59842
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
Low 2.1
CVE-2025-30370
jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"
High 7.4
CVE-2024-43805
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
High 7.6
CVE-2024-39700
Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action
Critical 10
CVE-2024-22421
Potential authentication and CSRF tokens leak in JupyterLab
High 7.6

Affected Vendor

Affected Software

jupyterlab
Vulnerable Versions:
>=4.0.0, < 4.0.11

Timeline

Official Publish: January 19th, 2024
Last Modified: May 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact