---
id: CVE-2021-32797
aliases:
  - GHSA-4952-p58q-6crx
  - BIT-jupyterlab-2021-32797
  - PYSEC-2021-130
  - PYSEC-2026-688
title: >-
  JupyterLab: XSS due to lack of sanitization of the action attribute of an html
  <form>
summary: >-
  JupyterLab: XSS due to lack of sanitization of the action attribute of an html
  <form>
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'
vendor: jupyterlab
product: jupyterlab
ecosystem: pip
affected:
  - jupyterlab < 1.2.21
  - 'jupyterlab >= 2.0.0a0, < 2.2.10'
  - 'jupyterlab >= 2.3.0a0, < 2.3.2'
  - 'jupyterlab >= 3.0.0a0, < 3.0.17'
  - 'jupyterlab >= 3.1.0a0, < 3.1.4'
  - notebook < 5.7.11
  - 'notebook >= 6.0.0, < 6.4.1'
patched:
  - jupyterlab 1.2.21
  - jupyterlab 2.2.10
  - jupyterlab 2.3.2
  - jupyterlab 3.0.17
  - jupyterlab 3.1.4
  - notebook 5.7.11
  - notebook 6.4.1
published: '2021-08-23'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4952-p58q-6crx'
references:
  - url: >-
      https://github.com/google/security-research/security/advisories/GHSA-c469-p3jp-2vhx
  - url: >-
      https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-32797'
  - url: >-
      https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab/PYSEC-2021-130.yaml
tags:
  - osv
  - pip
epss: 0.0266
epssPercentile: 0.85063
ingestedAt: '2026-07-08T18:25:45.297Z'
---

## Overview

### Impact

Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.

### Patches

Patched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21.

### References

[OWASP Page on Restricting Form Submissions](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.

Credit: Guillaume Jeanne from Google


## Affected packages

- `jupyterlab < 1.2.21`
- `jupyterlab >= 2.0.0a0, < 2.2.10`
- `jupyterlab >= 2.3.0a0, < 2.3.2`
- `jupyterlab >= 3.0.0a0, < 3.0.17`
- `jupyterlab >= 3.1.0a0, < 3.1.4`
- `notebook < 5.7.11`
- `notebook >= 6.0.0, < 6.4.1`

## Remediation

Upgrade to a patched release:

- `jupyterlab 1.2.21`
- `jupyterlab 2.2.10`
- `jupyterlab 2.3.2`
- `jupyterlab 3.0.17`
- `jupyterlab 3.1.4`
- `notebook 5.7.11`
- `notebook 6.4.1`