CVE-2024-22421: Fedoraproject Fedora

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.

Affected products

• Fedoraproject Fedora: version 39 only
• Jupyter Jupyterlab: before 3.6.7 (fixed in 3.6.7); from 4.0.0, before 4.0.11 (fixed in 4.0.11)
• Jupyter Notebook: from 7.0.0, before 7.0.7 (fixed in 7.0.7)

Published 2024-01-19. Last modified 2026-06-17.