JupyterLab PluginManager Lock Bypass Vulnerability (GHSA-h5v5-8746-g7mm)

Vulnerability Overview The PluginManager in JupyterLab contains a vulnerability that allows bypassing lock rule enforcement. This vulnerability allows authenticated users to bypass administrator-configured plugin enable/disable controls via direct API requests. Affected Versions Affected Versions: - - Fixed Versions: - - Impact Users can bypass Plugin Manager lock rules through direct API access: For multiple plugins covered by extensions When an administrator issues a "lock" request If integrity checks, hardcoded values, or restrictions (such as upload/download limits) are implemented within a plugin, these restrictions may be bypassed. Remediation Patched Versions: JupyterLab and contain the patch. Recommendation: Applications using JupyterLab (e.g., Notebook V7+) should update the package. Workaround Manually lock all plugins that should be locked. Core plugin identifiers can be found in the documentation, and identifiers for all installed extensions are listed in the Plugin Manager. References https://jupyterlab.readthedocs.io/en/stable/user/extensions.html#locking-and-unlocking-plugins https://jupyterlab.readthedocs.io/en/stable/user/extensions.html#managing-plugins-with-plugin-manager 4884195 Additional Information Severity: Medium (6.0 / 10) CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: Low - User Interaction: None - Confidentiality: Low - Integrity: High - Availability: None CVE ID: No known CVE Weaknesses: - CWE-602 - CWE-863 Contributors: - Repository: Reporter - MUFFANUJ: Remediation developer - krassowski: Coordinator

Goal Reached Thanks to every supporter — we hit 100%!

JupyterLab PluginManager Lock Bypass Vulnerability (GHSA-h5v5-8746-g7mm)

More from this source