External risk intelligence

JupyterLab Extension Template RCE Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-39700

The vulnerability exists within a development template used to scaffold code and its associated CI/CD build configuration files (GitHub Actions). This is a build-time and developer-focused component, not a runtime service or application that is deployed as an internet-facing network asset.

Code Injection

Jupyterlab

before 4.3.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a template used for creating JupyterLab extensions. This issue affects the automated testing workflow within repositories that use this template, potentially allowing for remote code execution. The primary concern is to confirm if any of your development pipelines utilize this specific template and are therefore exposed.

Code creation template has a security flaw.
Confirms relevance and exposure to this template.
Monitor development templates for potential risks.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by targeting repositories that were created using a specific JupyterLab extension template. If these repositories include the `update-integration-tests.yml` workflow, which is a GitHub Actions workflow, an attacker could potentially trigger a remote code execution. This could allow an attacker to gain significant control over the affected system.

No authentication or special access required.
Triggered via a GitHub Actions workflow.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect repositories created using a specific JupyterLab extension template. When configured with the `test` option, these repositories include a GitHub Actions workflow that contains a remote code execution flaw. This could impact the integrity of the code development process for extension authors.

Code integrity in repositories.
Exploited through a compromised workflow.
Development process disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in a development template for JupyterLab extensions, specifically within a GitHub Actions workflow. Extension authors hosting their code on GitHub are the primary actors. The initial step involves identifying all repositories utilizing this template, assessing their exposure, and confirming the accountable owner before planning remediation.

Extension authors own the issue.
Verify template usage and reachability.
Upgrade template and re-apply custom changes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the JupyterLab extension template?

It is a foundational boilerplate tool developers use to scaffold the directory structure and build configuration for new JupyterLab plugins. By automating the setup process, it ensures extensions are compatible with the JupyterLab ecosystem. The vulnerability exists within this generated infrastructure, specifically in the CI/CD scripts created to help developers automate their testing workflows.

What does CWE-94 mean for CVE-2024-39700?

CWE-94 refers to Improper Control of Generation of Code, commonly known as Code Injection. In the context of this CVE, it means the automated testing workflow allows external input to be executed as system-level commands. This bypasses the intended purpose of the test runner, enabling an attacker to run arbitrary, malicious instructions on the infrastructure hosting the workflow.

How can an attacker trigger this RCE vulnerability?

The flaw is triggered through the update-integration-tests.yml GitHub Action workflow. An attacker initiates the vulnerability by interacting with a repository that includes this specific, vulnerable test configuration. Importantly, repositories created without the 'test' option or those that have not implemented this specific automation workflow are not susceptible to this attack path.

Is this vulnerability a risk for my internet-facing servers?

According to Halo Surface Signal, this is a build-time and developer-focused concern rather than a runtime risk. Because the flaw resides in CI/CD automation files rather than an internet-facing network service, it is very unlikely to be reachable as a standard web application vulnerability. The primary danger is to your internal software development pipeline and code integrity.

What are the first steps to secure my projects?

Identify all repositories created with the older JupyterLab extension template and check if they contain the vulnerable workflow file. If found, upgrade to the latest template version. During the transition, you may want to temporarily disable GitHub Actions. If you have customized your integration tests, ensure you manually re-apply those specific changes after updating the template files.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.