Executive brief
JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
Affected products
- PyPI notebook
- PyPI jupyterlab
Junglewise Threat Intelligence
CVE-2021-32797: PYSEC-2026-688 - JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
CVE-2021-32797 · Severity: low · CVSS 3.1 · Published 2026-07-02
Technologies: notebook (PyPI), jupyterlab (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3671 - JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
- JupyterLab arbitrary code execution via malicious overrides.json
- JupyterLab extension blocklist bypass via package name variant
- PYSEC-2026-2682 - Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
- PYSEC-2026-2536 - HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering