Unsecured endpoints in the jupyter-lsp server extension

CVE-2024-22415

What is CVE-2024-22415?

The jupyter-lsp tool, integral for enhancing coding capabilities within JupyterLab via features like code navigation, linters, and autocompletion, is susceptible to a significant vulnerability affecting installations lacking proper file system access control on the operating system level. Environments exposed to untrusted networks can lead to unauthorized users gaining access beyond the jupyter root directory, allowing potential modification of file system contents. Users are strongly urged to upgrade to version 2.2.2, which addresses this vulnerability, or to uninstall the tool if upgrading is not feasible.

References