CVE-2024-22421 - CVE House
Back to Database
Status published High CVE-2024-22421

Potential authentication and CSRF tokens leak in JupyterLab

Vulnerability Description

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-22421

Credits & Attribution

No credits recorded in the NVD database.

References

More from jupyterlab

View All →
CVE-2025-59842
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
Low 2.1
CVE-2025-30370
jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"
High 7.4
CVE-2024-43805
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
High 7.6
CVE-2024-39700
Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action
Critical 10
CVE-2024-22420
Stored cross site scripting in Markdown Preview in JupyterLab
Medium 6.5

Affected Vendor

Affected Software

jupyterlab
Vulnerable Versions:
< 3.6.7, >=4.0.0,< 4.0.11

Timeline

Official Publish: January 19th, 2024
Last Modified: June 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-200 CWE-23

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration
T1190 Exploit Public-Facing Application
Initial Access
T1105 Ingress Tool Transfer
Command and Control
T1565 Data Manipulation
Impact