Describe the bug
graph-notebook==5.2.0 pins itables>=2.0.0,<=2.1.0 in pyproject.toml. This upper bound predates itables 2.4.0, in which HTML content in DataFrame cells is escaped by default (fix: mwouts/itables#346). In itables<=2.1.0, cell contents are passed verbatim to DataTables and rendered as live HTML/JS.
graph-notebook itself is not affected afaik, but it would be nice to relax itables version to avoid installing a vulnerable dependency
Environment
- OS: Ubuntu 24.04
- Browser: Google Chrome
- graph-notebook: 5.2.0
To Reproduce
In a fresh JupyterLab environment with graph-notebook==5.2.0 installed (which pulls itables==2.1.0), run:
import pandas as pd
from itables import show
results_df = pd.DataFrame({
"id": [1, 2, 3],
"name": [
"alice",
"bob",
'</script>\\"<script>alert(\'random text\')</script>',
],
})
show(results_df)
Expected behavior
No live html rendered
Describe the bug
graph-notebook==5.2.0pinsitables>=2.0.0,<=2.1.0inpyproject.toml. This upper bound predatesitables 2.4.0, in which HTML content in DataFrame cells is escaped by default (fix: mwouts/itables#346). Initables<=2.1.0, cell contents are passed verbatim to DataTables and rendered as live HTML/JS.graph-notebook itself is not affected afaik, but it would be nice to relax itables version to avoid installing a vulnerable dependency
Environment
To Reproduce
In a fresh JupyterLab environment with
graph-notebook==5.2.0installed (which pullsitables==2.1.0), run:Expected behavior
No live html rendered