← Vulnerability feed

Vulnerability record · CVE-2021-32797 · published 9 August 2021

CVE-2021-32797: Jupyterlab cross-site scripting vulnerability

Jupyter · Jupyterlab

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.

9.6 CVSS 3.1 Critical EPSS 2.7% · top 14.9% CWE-79 · Cross-site scripting
9.6CVSS 3.1 base score, v2 6.8
2.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed ExploitThird Party Advisory
https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx Third Party Advisory
https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed ExploitThird Party Advisory
https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx Third Party Advisory

Track CVE-2021-32797 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-39700Jupyterlab code injection vulnerabilityJupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `…EPSS 1.1%8.8CVE-2026-42266Jupyterlab argument injection vulnerabilityJupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, …EPSS 0.85%8.6CVE-2026-42557Jupyterlab cross-site scripting vulnerabilityjupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, Jupyt…EPSS 0.72%6.5CVE-2024-22421Jupyterlab relative path traversal vulnerabilityJupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterL…EPSS 0.67%6.1CVE-2024-43805Jupyterlab cross-site scripting vulnerabilityjupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability de…EPSS 0.40%6.1CVE-2024-22420Jupyterlab cross-site scripting vulnerabilityJupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerabilit…EPSS 0.57%2.1CVE-2025-59842Jupyterlab vulnerabilityjupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.…EPSS 0.24%6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed

Source: NIST National Vulnerability Database (record CVE-2021-32797), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.