JupyterLab Security Patch: XSS in Image Viewer, Plugin Manager Rule Enforcement Bypass, and PyPI Extension List Check Issues

Vulnerability Overview Multiple security vulnerabilities exist in the project, primarily involving Cross-Site Scripting (XSS) attacks and bypasses of the plugin manager's rule enforcement. Impact Scope Cross-Site Scripting (XSS) Attacks: - The image viewer allows XSS attacks when a malicious image is opened in a new browser tab. - Plugin manager rule enforcement can be bypassed in XSS attacks via a carefully crafted file. - The lack of forced in allows allowlist/blocklist checks to be bypassed. Plugin Manager Rule Enforcement Bypass: - Bypassing the plugin manager's rule enforcement may lead to the installation and execution of malicious plugins. Remediation Cross-Site Scripting (XSS) Attacks: - Patch the image viewer to prevent XSS attacks when malicious images are opened in new browser tabs. - Fix XSS attacks within the file to ensure plugin manager rules are enforced. - Enforce in to ensure allowlist/blocklist checks are correctly executed. Plugin Manager Rule Enforcement Bypass: - Fix the enforcement of plugin manager rules to ensure all plugin installations undergo rigorous checks. Proof of Concept (POC) Additional Information Security Patches: - Multiple security patches have been applied, including platform-specific keyboard shortcuts, incorrect table content markup, document loading, notebook initialization, kernel restart delays, Galata testing, bottom activity bar behavior, browser drag targets, Firefox notebook Galata testing, and more. Maintenance and Upgrade Improvements: - Jupyter Releaser GitHub Actions have been updated. Documentation Improvements: - Typos in release notes have been fixed, and the migration guide has been updated. Other Merged PRs: - Updated versions of and . Contributors Contributors to this release include , , , , and .

Goal Reached Thanks to every supporter — we hit 100%!

JupyterLab Security Patch: XSS in Image Viewer, Plugin Manager Rule Enforcement Bypass, and PyPI Extension List Check Issues

More from this source