https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 07:22:11 +0000 https://db.gcve.eu/vuln/ghsa-pppj-hq3g-57pj <p><strong>Affected:</strong> PyPI: jupyterlab</p> <p>JupyterLab 4.5+ allows notebook settings to be shared and applied through an `overrides.json` file using the `Import` button in the Settings Editor.</p> <p>Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructions that run as code inside JupyterLab when imported, instead of only changing a display preference.</p> <p>Because importing a settings file appears harmless, a user could import a file shared by another party without realizing it could do more. On multi-tenant file systems without proper permission control, another user could plant a malicious `overrides.json`.</p> <p>&gt; CVE assignment pending, GitHub CNA is experiencing severe backlog</p> <p>### Impact</p> <p>When a malicious settings file is applied, the embedded code runs with the same access as the affected user. This could allow an attacker to read or modify that user&#39;s notebooks and files, and to run code on the user&#39;s behalf through the notebook server, including on any connected kernel.</p> <p>#### User Interaction vs Privileges Required</p> <p>##### Write access to a loaded settings location</p> <p>If an attacker can write to a directory JupyterLab loads settings from (e.g. on shared or multi-tenant file system), they could place a crafted `overrides.json` that is applied to another user automatically at startup. This requires high privilages but no action by the victim.</p> <p>##### User-imported settings file</p> <p>A user can import a crafted `overrides.json` through t…</p> <p><strong>Affected:</strong> PyPI: jupyterlab</p> <p>JupyterLab 4.5+ allows notebook settings to be shared and applied through an `overrides.json` file using the `Import` button in the Settings Editor.</p> <p>Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructions that run as code inside JupyterLab when imported, instead of only changing a display preference.</p> <p>Because importing a settings file appears harmless, a user could import a file shared by another party without realizing it could do more. On multi-tenant file systems without proper permission control, another user could plant a malicious `overrides.json`.</p> <p>&gt; CVE assignment pending, GitHub CNA is experiencing severe backlog</p> <p>### Impact</p> <p>When a malicious settings file is applied, the embedded code runs with the same access as the affected user. This could allow an attacker to read or modify that user&#39;s notebooks and files, and to run code on the user&#39;s behalf through the notebook server, including on any connected kernel.</p> <p>#### User Interaction vs Privileges Required</p> <p>##### Write access to a loaded settings location</p> <p>If an attacker can write to a directory JupyterLab loads settings from (e.g. on shared or multi-tenant file system), they could place a crafted `overrides.json` that is applied to another user automatically at startup. This requires high privilages but no action by the victim.</p> <p>##### User-imported settings file</p> <p>A user can import a crafted `overrides.json` through t…</p> https://db.gcve.eu/vuln/ghsa-pppj-hq3g-57pj