TI-2024-26623 Aliases CVE-2024-39700

Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

HIGH 82CWE-94Published 2024-07-16 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting of this file and re-apply your changes later. Users may wish to temporarily disable GitHub Actions while working on the upgrade. We recommend rebasing all open pull requests from untrusted users as actions may run using the version from the `main` branch at the time when the pull request was created. Users who are upgrading from template version prior to 4.3.0 may wish to leave out proposed changes to the release workflow for now as it requires additional configuration.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01092 65th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed extension-template (jupyterlab): 4.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jupyterlab	extension-template	before 4.3.3	4.3.3	Patch available	CNA

extension-template Vendorjupyterlab Affected before 4.3.3 Fixed in 4.3.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jupyter:jupyterlab::::::::	before 4.3.0	Vulnerable	jupyterlab

cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* Versions before 4.3.0 Vulnerable ·jupyterlab

Remediation

Fix · CNA extension-template (jupyterlab) Fixed in 4.3.3

Timeline

2026-10-02 Threatist record created from CVE-2024-39700
2026-11-03 CISA SSVC decision points changed

References

Exploit 1

https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg

Patch 1

https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6

TI-2026-30579 Improper input validation in jupyterlab CVSS 3.1HIGH 8.8
TI-2021-12463 JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> CVSS 3.1CRITICAL 9.6
TI-2026-30837 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content CVSS 4.0HIGH 8.6
TI-2024-14994 Potential authentication and CSRF tokens leak in JupyterLab CVSS 3.1HIGH 7.6
TI-2024-29399 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering CVSS 3.1HIGH 7.6
TI-2024-14993 Stored cross site scripting in Markdown Preview in JupyterLab CVSS 3.1MEDIUM 6.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences