AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JupyterGHSA-6cwv-x26c-w2q4

Jupyter Notebook file bypasses sanitization, executes JavaScript

Jupyter

CVE-2018-8768 · Published Jul 12, 2018 · updated Dec 7, 2024

High7.8
Fix: upgrade to 5.4.1 or later
GitHub advisory

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

Affected versions

PackageAffectedFixed in
notebook
PyPI
< 5.4.15.4.1
Details and references
CVSS 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Also known as
CVE-2018-8768, PYSEC-2018-57

More Jupyter advisories

All Jupyter
Low 4.4Nov 18, 2020Open redirect in Jupyter NotebookCVE-2020-26215fixed in 6.1.5Medium 5.3Nov 8, 2019Cross-site scripting in Jupyter NotebookCVE-2018-21030fixed in 5.5.0rc1Medium 6.1Apr 9, 2019Jupyter Notebook open redirect vulnerabilityCVE-2019-10856fixed in 5.7.8Medium 6.1Apr 2, 2019Open Redirect vulnerability in jupyterhub and notebookCVE-2019-10255fixed in 0.9.6 +1Medium 6.1Nov 21, 2018Jupyter Notebook XSS via directory nameCVE-2018-19352fixed in 5.7.2Medium 6.1Nov 21, 2018Jupyter Notebook XSS via untrusted notebooksCVE-2018-19351fixed in 5.7.1