CVE-2024-39700 (CVSS 9.9): Severe Flaw in JupyterLab Template Discovered

by do son · July 24, 2024

A critical vulnerability, designated CVE-2024-39700, has been discovered in the widely-used JupyterLab extension template. This flaw could enable attackers to remotely execute code on affected systems, potentially leading to widespread compromise and data breaches.

The vulnerability stems from the automatic generation of the “update-integration-tests.yml” workflow file when the “test” option is selected during the extension creation process. This workflow file, designed to facilitate testing, unfortunately, contains a weakness that can be exploited to gain unauthorized control over the underlying systems hosting the JupyterLab extensions.

GitHub, which manages the Common Vulnerabilities and Exposures (CVE) system, has assigned the CVE-2024-39700 flaw a CVSSv3.1 base score of 9.9 – the highest possible severity rating. This underscores the urgency for users to take immediate action to mitigate the risk.

Developers who have created JupyterLab extensions using the vulnerable template and are hosting their code on GitHub are most at risk. Attackers could potentially exploit this flaw to inject malicious code, steal sensitive data, or disrupt operations.

To protect against potential exploitation, developers are strongly urged to follow these steps:

Update: Immediately upgrade the JupyterLab extension template to the latest version.
Overwrite: Replace the “update-integration-tests.yml” file with the version provided in the updated template. Re-apply any customizations carefully.
Disable (Temporarily): Deactivate GitHub Actions until the update process is complete.
Rebase: Ensure all open pull requests from untrusted sources are rebased to incorporate the security fix.