Afshin Taylor Darian

2 exploits Active since Aug 2021
CVE-2021-32797 WRITEUP HIGH WRITEUP
JupyterLab <1.2.21 - Notebook Code Execution via Unsanitized Form Action
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.
CVSS 7.4
CVE-2021-32798 WRITEUP CRITICAL WRITEUP
Jupyter Notebook < 5.7.11 - Stored Cross-Site Scripting via Caja Sanitizer Bypass
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
CVSS 10.0