Affected: PyPI: jupyterlite-core

## Description

A language pack ships a `Plural-Forms` header saying how the language counts, for example `nplurals=2; plural=(n != 1);`. JupyterLab turns that string into a function with `new Function`, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was anchored at the start but not at the end, so it accepted any string that began with a valid plural rule and ignored everything after it.

A header such as the following passed the check, and the part after the plural rule ran in the JupyterLab page as soon as the first plural string was translated:

``` nplurals=2; plural=(n > 1); <anything here ran as JavaScript> ```

Users are affected if all of the following are true:

- they run JupyterLab 3.0.0 through 4.6.3, or an application that bundles it such as Notebook 7; - a language pack they did not write is installed in the environment; and - that language is selected, so its catalogue is loaded

An installation using the default English locale loads no catalogue and is not affected.

> CVE assignment pending, GitHub CNA is experiencing severe backlog

### Impact

The code in the header ran in the JupyterLab page, in the same origin and session as the authenticated user. It could call the Jupyter Server REST API as that user: read and write any file under the server root, start a kernel and run code in it, and open a terminal where terminals are enabled. Nothing had to be clicked; translating one plural string was enough,…

Affected: PyPI: jupyterlab

## Description

A language pack ships a `Plural-Forms` header saying how the language counts, for example `nplurals=2; plural=(n != 1);`. JupyterLab turns that string into a function with `new Function`, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was anchored at the start but not at the end, so it accepted any string that began with a valid plural rule and ignored everything after it.

A header such as the following passed the check, and the part after the plural rule ran in the JupyterLab page as soon as the first plural string was translated:

``` nplurals=2; plural=(n > 1); <anything here ran as JavaScript> ```

Users are affected if all of the following are true:

- they run JupyterLab 3.0.0 through 4.6.3, or an application that bundles it such as Notebook 7; - a language pack they did not write is installed in the environment; and - that language is selected, so its catalogue is loaded

An installation using the default English locale loads no catalogue and is not affected.

> CVE assignment pending, GitHub CNA is experiencing severe backlog

### Impact

The code in the header ran in the JupyterLab page, in the same origin and session as the authenticated user. It could call the Jupyter Server REST API as that user: read and write any file under the server root, start a kernel and run code in it, and open a terminal where terminals are enabled. Nothing had to be clicked; translating one plural string was enough,…

Affected: PyPI: jupyterlab

JupyterLab's PyPI extension manager runs `python -m pip uninstall` with the extension name taken from the request body. `ExtensionHandler.post` validates the name for `cmd=install` but not for `cmd=uninstall`, so a name that begins with `-` reaches the command line and pip reads it as an option rather than as a package.

```python cmdline = [ sys.executable, "-m", "pip", "uninstall", "--yes", "--no-input", extension, ] ```

An extension name of the form `-r` followed by a path therefore made pip open that path as a requirements file. pip's parse error quotes the line it could not read and names the file it came from, and JupyterLab returned that error in the response body, so the line reached the requester.

This has security implications only for deployments that combine all of the following:

- the (default) PyPI Extension Manager enabled, so that uninstall requests reach pip; - an authenticated account permitted to call the extension API; and - kernels and terminals disabled or delegated to remote hosts (otherwise a user with kernel access can read the same files and make the same outbound requests directly, regardless of this endpoint)

Unlike [GHSA-37w4-hwhx-4rc4](https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4) and [GHSA-89vp-jrxv-24w8](https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-89vp-jrxv-24w8), this does not need an allowlist or blocklist to be configured. The uninstall path never cons…

Affected: PyPI: jupyterlite-core

## Description

JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing `metadata.trusted`, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output and evaluates the `<script>` elements it contains, so pasting the cell runs attacker's JavaScript in the JupyterLab origin. The same payload with `"trusted": false` is sanitized.

```json [ { "cell_type": "code", "execution_count": null, "source": "", "metadata": { "trusted": true }, "outputs": [ { "output_type": "display_data", "metadata": {}, "data": { "text/html": "<script>/* runs on paste */</script>" } } ] } ] ```

Users are affected if all of the following are true:

- they run JupyterLab 4.5.0 through 4.6.3, or an application that bundles it such as Notebook 7.5+; - if running 4.5.2 or newer, `useSystemClipboardForCells` is enabled - it is off by default in 4.5.2+, and always enabled on 4.5.0 and 4.5.1 with no opt-out - they run a Paste Cells command (e.g. from context menu, command palette, shortcut) while attacker-controlled text is in the clipboard; and - `pasteCodeCellsWithoutOutput` is off, the default, so the pasted cell keeps its outputs

### Impact

The script runs in the JupyterLab page, in the same origin and session as the authenticated user, so it can call the Jupyter Server REST API as that use…

Affected: PyPI: jupyterlite

## Description

JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing `metadata.trusted`, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output and evaluates the `<script>` elements it contains, so pasting the cell runs attacker's JavaScript in the JupyterLab origin. The same payload with `"trusted": false` is sanitized.

```json [ { "cell_type": "code", "execution_count": null, "source": "", "metadata": { "trusted": true }, "outputs": [ { "output_type": "display_data", "metadata": {}, "data": { "text/html": "<script>/* runs on paste */</script>" } } ] } ] ```

Users are affected if all of the following are true:

- they run JupyterLab 4.5.0 through 4.6.3, or an application that bundles it such as Notebook 7.5+; - if running 4.5.2 or newer, `useSystemClipboardForCells` is enabled - it is off by default in 4.5.2+, and always enabled on 4.5.0 and 4.5.1 with no opt-out - they run a Paste Cells command (e.g. from context menu, command palette, shortcut) while attacker-controlled text is in the clipboard; and - `pasteCodeCellsWithoutOutput` is off, the default, so the pasted cell keeps its outputs

### Impact

The script runs in the JupyterLab page, in the same origin and session as the authenticated user, so it can call the Jupyter Server REST API as that use…

Affected: PyPI: notebook

## Description

JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing `metadata.trusted`, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output and evaluates the `<script>` elements it contains, so pasting the cell runs attacker's JavaScript in the JupyterLab origin. The same payload with `"trusted": false` is sanitized.

```json [ { "cell_type": "code", "execution_count": null, "source": "", "metadata": { "trusted": true }, "outputs": [ { "output_type": "display_data", "metadata": {}, "data": { "text/html": "<script>/* runs on paste */</script>" } } ] } ] ```

Users are affected if all of the following are true:

- they run JupyterLab 4.5.0 through 4.6.3, or an application that bundles it such as Notebook 7.5+; - if running 4.5.2 or newer, `useSystemClipboardForCells` is enabled - it is off by default in 4.5.2+, and always enabled on 4.5.0 and 4.5.1 with no opt-out - they run a Paste Cells command (e.g. from context menu, command palette, shortcut) while attacker-controlled text is in the clipboard; and - `pasteCodeCellsWithoutOutput` is off, the default, so the pasted cell keeps its outputs

### Impact

The script runs in the JupyterLab page, in the same origin and session as the authenticated user, so it can call the Jupyter Server REST API as that use…

Affected: PyPI: jupyterlab

## Description

JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing `metadata.trusted`, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output and evaluates the `<script>` elements it contains, so pasting the cell runs attacker's JavaScript in the JupyterLab origin. The same payload with `"trusted": false` is sanitized.

```json [ { "cell_type": "code", "execution_count": null, "source": "", "metadata": { "trusted": true }, "outputs": [ { "output_type": "display_data", "metadata": {}, "data": { "text/html": "<script>/* runs on paste */</script>" } } ] } ] ```

Users are affected if all of the following are true:

- they run JupyterLab 4.5.0 through 4.6.3, or an application that bundles it such as Notebook 7.5+; - if running 4.5.2 or newer, `useSystemClipboardForCells` is enabled - it is off by default in 4.5.2+, and always enabled on 4.5.0 and 4.5.1 with no opt-out - they run a Paste Cells command (e.g. from context menu, command palette, shortcut) while attacker-controlled text is in the clipboard; and - `pasteCodeCellsWithoutOutput` is off, the default, so the pasted cell keeps its outputs

### Impact

The script runs in the JupyterLab page, in the same origin and session as the authenticated user, so it can call the Jupyter Server REST API as that use…

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing the embedded files through the dictionary-based API.

### Patches

This has been fixed in [pypdf==6.19.0](https://github.com/py-pdf/pypdf/releases/tag/6.19.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4081](https://github.com/py-pdf/pypdf/pull/4081).

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation.

### Patches

This has been fixed in [pypdf==6.19.0](https://github.com/py-pdf/pypdf/releases/tag/6.19.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4087](https://github.com/py-pdf/pypdf/pull/4087).

Affected: PyPI: pypdf

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing the page labels of a document with large alphabetical labels.

### Patches

This has been fixed in [pypdf==6.19.0](https://github.com/py-pdf/pypdf/releases/tag/6.19.0).

### Workarounds

If you cannot upgrade yet, consider applying the changes from PR [#4096](https://github.com/py-pdf/pypdf/pull/4096).