DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-PPPJ-HQ3G-57PJ: GHSA-pppj-hq3g-57pj: DOM-based Cross-Site Scripting (XSS) via Malicious Settings Override in JupyterLab

#security #cve #cybersecurity #ghsa

GHSA-pppj-hq3g-57pj: DOM-based Cross-Site Scripting (XSS) via Malicious Settings Override in JupyterLab

Vulnerability ID: GHSA-PPPJ-HQ3G-57PJ
CVSS Score: 8.6
Published: 2026-07-22

JupyterLab versions 4.5.x and 4.6.x prior to 4.5.10 and 4.6.2 are vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker can craft a malicious overrides.json file that executes arbitrary JavaScript inside the victim's browser session. This can occur either automatically if the file is pre-planted on a multi-tenant filesystem, or via user interaction when importing settings.

TL;DR

A DOM-based Cross-Site Scripting (XSS) vulnerability in JupyterLab allows unauthenticated attackers to execute arbitrary JavaScript in a victim's session via a crafted 'overrides.json' file, potentially leading to remote command execution on the Jupyter backend.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS v4.0: 8.6 (High)
  • Impact: Arbitrary JavaScript Execution / RCE via Kernels
  • Exploit Status: PoC Conceptual
  • KEV Status: Not Listed

Affected Systems

  • JupyterLab
  • jupyterlab: >= 4.6.0, <= 4.6.1 (Fixed in: 4.6.2)
  • jupyterlab: >= 3.3.0, <= 4.5.9 (Fixed in: 4.5.10)

Code Analysis

Commit: be9303f

Ensure style overrides are safe from script injection

Commit: f1beab4

Enforce safe style injection in notebook extension tracker

Mitigation Strategies

  • Upgrade to JupyterLab 4.6.2 or 4.5.10 depending on the current branch.
  • Restrict write access to system-wide Jupyter configuration paths on shared environments.
  • Audit and validate any overrides.json file before import.

Remediation Steps:

  1. Identify current JupyterLab installations via pip list or conda list.
  2. Execute upgrade commands: pip install --upgrade jupyterlab>=4.6.2 or pip install --upgrade jupyterlab>=4.5.10 depending on major version requirements.
  3. Enforce file permissions using chmod on shared configuration directories to prevent write access by non-privileged users.

References

Read the full report for GHSA-PPPJ-HQ3G-57PJ on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)