# CVE-2024-39700: Remote Code Execution (RCE) vulnerability in jupyterlab extension template  `update-integration-tests` GitHub Action

Status: published. Published: 2024-07-16. Updated: 2026-11-03.

JupyterLab extension template is a  `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting of this file and re-apply your changes later. Users may wish to temporarily disable GitHub Actions while working on the upgrade. We recommend rebasing all open pull requests from untrusted users as actions may run using the version from the `main` branch at the time when the pull request was created. Users who are upgrading from template version prior to 4.3.0 may wish to leave out proposed changes to the release workflow for now as it requires additional configuration.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: security-advisories@github.com) — https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: af854a3a-2127-422b-91ae-364da2661108) — https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6

## Affected products and versions

- jupyterlab / extension-template: < 4.3.3 (affected). Source: CNA: GitHub_M
- jupyter / extension-template: ≥ 0; < 4.3.3 (affected, custom). Source: ADP: CISA-ADP

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "4.3.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 10 (critical); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; source: CNA: GitHub_M

- CVSS 3.1: 9.8 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: NVD: nvd@nist.gov

- CVSS 3.1: 9.9 (critical); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; source: NVD: security-advisories@github.com

- CISA KEV: No listing in collected sources

- EPSS: 1.09% as of 2026-11-03; percentile 65.46%

- SSVC: exploitation poc; automatable yes; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-94

## Exploit evidence

- exploit: https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg (security-advisories@github.com)
- exploit: https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg (af854a3a-2127-422b-91ae-364da2661108)

## References

- https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg (ADP: CVE; x_refsource_CONFIRM, x_transferred)

- https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6 (ADP: CVE; x_refsource_MISC, x_transferred)

- https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6 (security-advisories@github.com; Patch)

- https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg (security-advisories@github.com; Exploit, Vendor Advisory)

- https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6 (af854a3a-2127-422b-91ae-364da2661108; Patch)

- https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg (af854a3a-2127-422b-91ae-364da2661108; Exploit, Vendor Advisory)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2024-39700; retrieved 2026-11-03; source updated 2026-11-03

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39700; retrieved 2026-11-04; source updated 2026-11-03

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2024-39700; retrieved 2026-11-03; source updated Not reported

Revision: f89f0e04f6a0603df0e8ba553117e596d4cf241c45d7807ebcbe8f726bc2c269

Canonical: https://y2.dev/cve/CVE-2024-39700

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.