Executive brief
Nteract is a popular open-source notebook environment for interactive computing and data analysis. A vulnerability in version 0.28.0 allows attackers to execute arbitrary code by crafting a malicious Markdown link in a notebook, potentially compromising the integrity and confidentiality of data and systems running the application.
Technical details
The vulnerability is a code injection issue (CWE-94) affecting Nteract up to version 0.28.0, where the application unsafely processes Markdown links. An attacker can craft a malicious Markdown link that, when rendered or clicked, triggers remote code execution on the user's machine. No authentication is required; the attack vector is rendering or interacting with a notebook containing the malicious link. The precise patch status is unknown from the advisory, but proof-of-concept exploits have been published.
Affected products
- Nteract nteract 0.28.0 and earlier
Timeline
- 2024-03-01: disclosed
- 2024-03-01: advisory