JupyterGHSA-hhx8-cr55-qcxx
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
Medium5.4CVE-2019-9644 · Published May 14, 2022 · updated Jul 13, 2026
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| notebook PyPI | < 5.7.6 | 5.7.6 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2019-9644, PYSEC-2019-159, PYSEC-2026-2531
- nvd.nist.gov/vuln/detail/CVE-2019-9644
- github.com/jupyter/notebook
- github.com/jupyter/notebook/compare/f3f00df...05aa4b2
- github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2019-159.yaml
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 162022 | Jupyter server Token bruteforcing High7.1Jun 16, 2022 | High7.1 | 1.17.1+1 more |
| Jun 162022 | Token bruteforcingMedium4.3Jun 16, 2022 | Medium4.3 | 6.4.12 |
| May 242022 | Cross-Site Request Forgery in JupyterHubMedium4.5May 24, 2022 | Medium4.5 | 1.2.0b1 |
| May 172022 | Improper Input Validation in Jupyter NotebookCritical9.8May 17, 2022 | Critical9.8 | 4.0.5+1 more |
| May 142022 | Improper Neutralization of Input During Web Page Generation in Jupyter NotebookMedium6.1May 14, 2022 | Medium6.1 | 4.0.5+1 more |
| Apr 52022 | Sensitive Auth & Cookie data stored in Jupyter server logsHigh7.5Apr 5, 2022 | High7.5 | 6.4.10 |