CVE-2024-39700 is a critical Remote Code Execution (RCE) vulnerability affecting JupyterLab extensions created using the JupyterLab extension template with the 'test' option. Specifically, the 'update-integration-tests.yml' workflow in these repositories contains the flaw. With a CVSS score of 9.8 (Critical), this vulnerability allows unauthenticated attackers to execute arbitrary code remotely with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While there are no known public exploits or Metasploit modules, the vulnerability has garnered some community discussion, indicating awareness among developers. Users are strongly advised to upgrade their templates, disable GitHub Actions temporarily during the upgrade, and rebase untrusted pull requests.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.3.0CPE matchmatch criteria | cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.