pyup/pin-pytest-asyncio-0.23.2
1 year, 10 months ago
Pin pytest-asyncio to latest version 0.23.2
jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/pin-pytest-asyncio-0.23.1
1 year, 10 months ago
Pin pytest-asyncio to latest version 0.23.1
jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/pin-pytest-asyncio-0.23.0
1 year, 10 months ago
Pin pytest-asyncio to latest version 0.23.0
jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/pin-aiohttp-3.9.1
1 year, 10 months ago
Pin aiohttp to latest version 3.9.1
jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/update-jupyterlab-git-0.8.1-to-0.50.0
1 year, 10 months ago
Update jupyterlab-git from 0.8.1 to 0.50.0
jupyterlab 1.0.9 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
pyup/update-jupyterlab-1.0.9-to-4.0.9
1 year, 10 months ago
Update jupyterlab from 1.0.9 to 4.0.9
jupyterlab-git 0.8.1 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/pin-aiohttp-3.9.0
1 year, 10 months ago
Pin aiohttp to latest version 3.9.0
jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/update-jupyterlab-1.0.9-to-4.0.8
1 year, 11 months ago
Update jupyterlab from 1.0.9 to 4.0.8
jupyterlab-git 0.8.1 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/pin-pytest-asyncio-0.22.0
1 year, 11 months ago
Pin pytest-asyncio to latest version 0.22.0
jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/pin-pytest-7.4.3
1 year, 11 months ago
Pin pytest to latest version 7.4.3
jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/update-jupyterlab-git-0.8.1-to-0.44.0
1 year, 11 months ago
Update jupyterlab-git from 0.8.1 to 0.44.0
jupyterlab 1.0.9 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
pyup/update-jupyterlab-1.0.9-to-4.0.7
1 year, 11 months ago
Update jupyterlab from 1.0.9 to 4.0.7
jupyterlab-git 0.8.1 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/pin-aiohttp-3.8.6
1 year, 11 months ago
Pin aiohttp to latest version 3.8.6
jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
pyup/update-jupyterlab-git-0.8.1-to-0.43.0
2 years ago
Update jupyterlab-git from 0.8.1 to 0.43.0
jupyterlab 1.0.9 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab | 1.0.9 | <4.4.8 |
show Affected versions of the jupyterlab package are vulnerable to Reverse Tabnabbing due to LaTeX typesetter–generated links not enforcing the noopener attribute. Links produced by LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook omit rel=noopener, and if a (third-party) typesetter also adds target=_blank, the newly opened page can access window.opener. |
| jupyterlab | 1.0.9 | >=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21 |
show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed |
| jupyterlab | 1.0.9 | >=4.0.0,<=4.0.10 , <=3.6.6 |
show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947 |
| jupyterlab | 1.0.9 | <3.1.0 |
show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability. |
| jupyterlab | 1.0.9 | <3.1.0b2 |
show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability. |
| jupyterlab | 1.0.9 | <3.0.8 |
show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>. |
| jupyterlab | 1.0.9 | <=3.6.7 , >=4.0.0a0,<=4.2.4 |
show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab. |
pyup/update-jupyterlab-1.0.9-to-4.0.6
2 years ago
Update jupyterlab from 1.0.9 to 4.0.6
jupyterlab-git 0.8.1 has known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| jupyterlab-git | 0.8.1 | <0.32.0 |
show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings. |
| jupyterlab-git | 0.8.1 | <0.51.1 |
show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. |
Python 3 badge
URL
https://pyup.io/repos/github/asmodehn/boken/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/asmodehn/boken/)
Restructured Text
.. image:: https://pyup.io/repos/github/asmodehn/boken/python-3-shield.svg
:target: https://pyup.io/repos/github/asmodehn/boken/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/asmodehn/boken/"><img src="https://pyup.io/repos/github/asmodehn/boken/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/asmodehn/boken/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/asmodehn/boken/
RDoc
{<img src="https://pyup.io/repos/github/asmodehn/boken/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/asmodehn/boken/]
pyup.io badge
URL
https://pyup.io/repos/github/asmodehn/boken/shield.svg
Markdown
[](https://pyup.io/repos/github/asmodehn/boken/)
Restructured Text
.. image:: https://pyup.io/repos/github/asmodehn/boken/shield.svg
:target: https://pyup.io/repos/github/asmodehn/boken/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/asmodehn/boken/"><img src="https://pyup.io/repos/github/asmodehn/boken/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/asmodehn/boken/shield.svg(Updates)!:https://pyup.io/repos/github/asmodehn/boken/
RDoc
{<img src="https://pyup.io/repos/github/asmodehn/boken/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/asmodehn/boken/]