CVE-2021-32797 is a critical remote code execution (RCE) vulnerability affecting JupyterLab, where untrusted notebooks can execute code upon loading due to improper sanitization of HTML form attributes. This vulnerability carries a CVSS score of 9.6 (CRITICAL) and a FAUCET Risk Score of 77/100, indicating a high potential for impact (confidentiality, integrity, and availability) with low attack complexity, though it requires user interaction to open a malicious notebook. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.21CPE matchmatch criteria | cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* | ||
>= 2.0.0, < 2.2.10CPE matchmatch criteria | cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* | ||
>= 2.3.0, < 2.3.2CPE matchmatch criteria | cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* | ||
>= 3.0.0, < 3.0.17CPE matchmatch criteria | cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* | ||
>= 3.1.0, < 3.1.4CPE matchmatch criteria | cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.