CVE-2024-22415

    Dashboard / Vulnerabilities / CVE-2024-22415

    CVE-2024-22415

    Published: 18 Jan 2024Last Modified: 12 Aug 2026

    Summary: Unsecured endpoints in the jupyter-lsp server extension

    Details: jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. This issue has been patched in version 2.2.2 and all users are advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22415.json, https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp-652w-c22x, https://nvd.nist.gov/vuln/detail/CVE-2024-22415, https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32137c647baaff044e95

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4ad12f204ad0b85580fc32137c647baaff044e95

    Affected versions

    v5.0.1
    v5.0.0
    v5.0.0rc1
    v5.0.0rc0
    v5.0.0b1
    v5.0.0b0
    v5.0.0a0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-22415 | CVE-DB