---
id: CVE-2024-22420
aliases:
  - GHSA-4m77-cmpx-vjc4
  - BIT-jupyter-base-notebook-2024-22420
  - BIT-jupyter-notebook-2024-22420
  - BIT-jupyterlab-2024-22420
  - PYSEC-2026-1707
  - PYSEC-2026-2535
title: JupyterLab vulnerable to SXSS in Markdown Preview
summary: JupyterLab vulnerable to SXSS in Markdown Preview
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
vendor: jupyterlab
product: jupyterlab
ecosystem: pip
affected:
  - 'jupyterlab >= 4.0.0, < 4.0.11'
  - 'notebook >= 7.0.0, < 7.0.7'
patched:
  - jupyterlab 4.0.11
  - notebook 7.0.7
published: '2024-01-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:04.771668650Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4m77-cmpx-vjc4'
references:
  - url: >-
      https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-22420'
  - url: >-
      https://github.com/jupyterlab/jupyterlab/commit/dda0033cd49449572d077bbecd33b18d8d05f48a
  - url: >-
      https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2df
  - url: 'https://github.com/jupyterlab/jupyterlab'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H
tags:
  - osv
  - pip
epss: 0.00573
epssPercentile: 0.4501
ingestedAt: '2026-07-08T18:25:45.506Z'
---

## Overview

### Impact

The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.

A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.

### Patches

JupyterLab v4.0.11 was patched.

### Workarounds

Users can either disable the table of contents extension by running:

```bash
jupyter labextension disable @jupyterlab/toc-extension:registry
```

### References

Vulnerability reported via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).


## Affected packages

- `jupyterlab >= 4.0.0, < 4.0.11`
- `notebook >= 7.0.0, < 7.0.7`

## Remediation

Upgrade to a patched release:

- `jupyterlab 4.0.11`
- `notebook 7.0.7`