JupyterGHSA-49qr-xh3w-h436
Jupyter Notebook XSS via untrusted notebooks
Medium6.1CVE-2018-19351 · Published Nov 21, 2018 · updated Sep 27, 2024
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| notebook PyPI | < 5.7.1 | 5.7.1 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2018-19351, PYSEC-2018-17
- nvd.nist.gov/vuln/detail/CVE-2018-19351
- github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491
- github.com/jupyter/notebook
- github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
- github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2018-17.yaml
- groups.google.com/forum/#!topic/jupyter/hWzu2BSsplY
- lists.debian.org/debian-lts-announce/2020/11/msg00033.html
- pypi.org/project/notebook/#history
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 182020 | Open redirect in Jupyter Notebook Low4.4Nov 18, 2020 | Low4.4 | 6.1.5 |
| Nov 82019 | Cross-site scripting in Jupyter NotebookMedium5.3Nov 8, 2019 | Medium5.3 | 5.5.0rc1 |
| Apr 92019 | Jupyter Notebook open redirect vulnerabilityMedium6.1Apr 9, 2019 | Medium6.1 | 5.7.8 |
| Apr 22019 | Open Redirect vulnerability in jupyterhub and notebookMedium6.1Apr 2, 2019 | Medium6.1 | 0.9.6+1 more |
| Nov 212018 | Jupyter Notebook XSS via directory nameMedium6.1Nov 21, 2018 | Medium6.1 | 5.7.2 |
| Jul 122018 | Jupyter Notebook file bypasses sanitization, executes JavaScriptHigh7.8Jul 12, 2018 | High7.8 | 5.4.1 |