Safety CI > asmodehn/boken

pyup/pin-pytest-7.1.3

2 years, 10 months ago

36220131

Pin pytest to latest version 7.1.3

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-git-0.8.1-to-0.39.1

2 years, 10 months ago

a20ba8dc

Update jupyterlab-git from 0.8.1 to 0.39.1

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.

pyup/update-ipympl-0.3.3-to-0.9.2

2 years, 10 months ago

0d6f1e6f

Update ipympl from 0.3.3 to 0.9.2

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-git-0.8.1-to-0.39.0

2 years, 10 months ago

c2e38143

Update jupyterlab-git from 0.8.1 to 0.39.0

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.

pyup/update-jupyterlab-git-0.8.1-to-0.38.0

2 years, 10 months ago

2a0c1703

Update jupyterlab-git from 0.8.1 to 0.38.0

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.

pyup/update-jupyterlab-1.0.9-to-3.4.5

2 years, 10 months ago

2b9b9bd1

Update jupyterlab from 1.0.9 to 3.4.5

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-1.0.9-to-3.4.4

2 years, 11 months ago

fe206c5a

Update jupyterlab from 1.0.9 to 3.4.4

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/pin-pytest-asyncio-0.19.0

2 years, 11 months ago

779e073e

Pin pytest-asyncio to latest version 0.19.0

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/pin-pytest-recording-0.12.1

3 years ago

283c8e54

Pin pytest-recording to latest version 0.12.1

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-1.0.9-to-3.4.3

3 years ago

4acd2047

Update jupyterlab from 1.0.9 to 3.4.3

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-1.0.9-to-3.4.2

3 years, 1 month ago

b24562b0

Update jupyterlab from 1.0.9 to 3.4.2

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-1.0.9-to-3.4.1

3 years, 1 month ago

71adca0c

Update jupyterlab from 1.0.9 to 3.4.1

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-1.0.9-to-3.4.0

3 years, 2 months ago

a7a4f808

Update jupyterlab from 1.0.9 to 3.4.0

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-git-0.8.1-to-0.37.1

3 years, 2 months ago

01111c26

Update jupyterlab-git from 0.8.1 to 0.37.1

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.

pyup/update-jupyterlab-git-0.8.1-to-0.37.0

3 years, 2 months ago

af0e189d

Update jupyterlab-git from 0.8.1 to 0.37.0

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.