CVE-2024-39700

Repositories created using the template with the `test` option enabled contain a vulnerable `update-integration-tests.yml` workflow file. An attacker can create a malicious pull request to a repository based on this template, and since GitHub Actions can be executed from the version found in the `main` branch at the time the pull request is opened, untrusted code can be executed in the CI/CD environment without required authorization.

An attacker can remotely execute arbitrary code in the CI/CD environment (GitHub Actions) of the victim's repository, which can lead to theft of secrets, modification of source code, or compromise of the entire deployment pipeline.

Update the extension template to the latest version and overwrite the `update-integration-tests.yml` file, then reapply your own changes. It is recommended to temporarily disable GitHub Actions during the update process. All open pull requests from untrusted users should be rebased. Users migrating from versions before 4.3.0 should skip the proposed changes in the release workflow until additional configuration is completed.

JupyterLab extension repositories created using the `jupyterlab/extension-template` template with the `test` option enabled, hosted on GitHub — in template versions before the latest patch (especially before version 4.3.0).