Junglewise Threat Intelligence

CVE-2024-22891: Nteract remote code execution via Markdown link

CVE-2024-22891 · Severity: info · Published 2024-03-01

Vendors: npm.

Executive brief

Nteract is a popular open-source notebook environment for interactive computing and data analysis. A vulnerability in version 0.28.0 allows attackers to execute arbitrary code by crafting a malicious Markdown link in a notebook, potentially compromising the integrity and confidentiality of data and systems running the application.

Technical details

The vulnerability is a code injection issue (CWE-94) affecting Nteract up to version 0.28.0, where the application unsafely processes Markdown links. An attacker can craft a malicious Markdown link that, when rendered or clicked, triggers remote code execution on the user's machine. No authentication is required; the attack vector is rendering or interacting with a notebook containing the malicious link. The precise patch status is unknown from the advisory, but proof-of-concept exploits have been published.

Affected products

  • Nteract nteract 0.28.0 and earlier

Timeline

  • 2024-03-01: disclosed
  • 2024-03-01: advisory

References