id: PYSEC-2026-2535
published: "2026-07-13T14:20:02.558089Z"
modified: "2026-07-13T16:04:23.598489Z"
aliases:
- CVE-2024-22420
- GHSA-4m77-cmpx-vjc4
summary: JupyterLab vulnerable to SXSS in Markdown Preview
details: "### Impact\n\nThe vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.\n\nA malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.\n\n### Patches\n\nJupyterLab v4.0.11 was patched.\n\n### Workarounds\n\nUsers can either disable the table of contents extension by running:\n\n```bash\njupyter labextension disable @jupyterlab/toc-extension:registry\n```\n\n### References\n\nVulnerability reported via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).\n"
affected:
- package:
    name: jupyterlab
    ecosystem: PyPI
    purl: pkg:pypi/jupyterlab
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 4.0.0
    - fixed: 4.0.11
  versions:
  - 4.0.0
  - 4.0.1
  - 4.0.10
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.0.5
  - 4.0.6
  - 4.0.7
  - 4.0.8
  - 4.0.9
references:
- type: WEB
  url: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-22420
- type: WEB
  url: https://github.com/jupyterlab/jupyterlab/commit/dda0033cd49449572d077bbecd33b18d8d05f48a
- type: WEB
  url: https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2df
- type: PACKAGE
  url: https://github.com/jupyterlab/jupyterlab
- type: WEB
  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H
- type: PACKAGE
  url: https://pypi.org/project/jupyterlab
- type: ADVISORY
  url: https://github.com/advisories/GHSA-4m77-cmpx-vjc4
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N