---
id: CVE-2024-22421
aliases:
  - GHSA-44cc-43rp-5947
  - BIT-jupyter-base-notebook-2024-22421
  - BIT-jupyter-notebook-2024-22421
  - BIT-jupyterlab-2024-22421
  - PYSEC-2026-1706
  - PYSEC-2026-2534
title: JupyterLab vulnerable to potential authentication and CSRF tokens leak
summary: JupyterLab vulnerable to potential authentication and CSRF tokens leak
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L'
vendor: jupyterlab
product: jupyterlab
ecosystem: pip
affected:
  - 'jupyterlab >= 4.0.0, < 4.0.11'
  - jupyterlab < 3.6.7
  - 'notebook >= 7.0.0, < 7.0.7'
patched:
  - jupyterlab 4.0.11
  - jupyterlab 3.6.7
  - notebook 7.0.7
published: '2024-01-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:04.786005565Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-44cc-43rp-5947'
references:
  - url: >-
      https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-22421'
  - url: >-
      https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6
  - url: >-
      https://github.com/jupyterlab/jupyterlab/commit/1ef7a4fa0202ebdf663e1cc0b45c8813a34a0b96
  - url: >-
      https://github.com/jupyterlab/jupyterlab/commit/fccd83dc4441da0384ee3fd1322c3b2d9ad4caaa
  - url: 'https://github.com/jupyterlab/jupyterlab'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H
tags:
  - osv
  - pip
epss: 0.0067
epssPercentile: 0.4989
ingestedAt: '2026-07-08T18:25:45.247Z'
---

## Overview

### Impact
Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version.

### Patches
JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched.

### Workarounds
No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.

### References

Vulnerability reported by user @davwwwx via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).


## Affected packages

- `jupyterlab >= 4.0.0, < 4.0.11`
- `jupyterlab < 3.6.7`
- `notebook >= 7.0.0, < 7.0.7`

## Remediation

Upgrade to a patched release:

- `jupyterlab 4.0.11`
- `jupyterlab 3.6.7`
- `notebook 7.0.7`