Advisoriesby IbisJupyterGHSA-49qr-xh3w-h436
Jupyter Notebook XSS via untrusted notebooks
Fix: upgrade to 5.7.1 or later
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| notebook PyPI | < 5.7.1 | 5.7.1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2018-19351, PYSEC-2018-17
- nvd.nist.gov/vuln/detail/CVE-2018-19351
- github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491
- github.com/jupyter/notebook
- github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
- github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2018-17.yaml
- groups.google.com/forum/#!topic/jupyter/hWzu2BSsplY
- lists.debian.org/debian-lts-announce/2020/11/msg00033.html
- pypi.org/project/notebook/#history
More Jupyter advisories
All Jupyter
Open redirect in Jupyter NotebookCVE-2020-26215fixed in 6.1.5Cross-site scripting in Jupyter NotebookCVE-2018-21030fixed in 5.5.0rc1Jupyter Notebook open redirect vulnerabilityCVE-2019-10856fixed in 5.7.8Open Redirect vulnerability in jupyterhub and notebookCVE-2019-10255fixed in 0.9.6 +1Jupyter Notebook XSS via directory nameCVE-2018-19352fixed in 5.7.2Jupyter Notebook file bypasses sanitization, executes JavaScriptCVE-2018-8768fixed in 5.4.1