notebook

Jupyter Interactive Notebook

View on Pypi

View on Github

Activity

Latest release: 1mo ago
Total releases: 212
Cadence: ~7 days
Last 12 months: 26

Reach

Stars: 13.3k

Details

License: custom
First release: Jul 30, 2015

Releases

Version	Released
`7.6.2` patch	Aug 11, 2026
`7.6.1` patch	Jul 22, 2026
`7.7.0a1` pre	Jul 22, 2026
`7.7.0a0` pre	Jul 06, 2026
`7.6.0` minor	Jun 18, 2026
`7.6.0rc1` pre	Jun 17, 2026
`7.6.0rc0` pre	Jun 10, 2026
`7.5.7` patch	Jun 04, 2026
`7.6.0b1` pre	May 29, 2026
`7.6.0b0` pre	May 21, 2026
`7.5.6` patch	Apr 30, 2026
`7.6.0a5` pre	Apr 30, 2026
`7.6.0a4` pre	Mar 12, 2026
`7.5.5` patch 2 CVEs	Mar 11, 2026
`7.5.4` patch 2 CVEs	Feb 24, 2026
`7.6.0a3` pre	Feb 24, 2026
`7.5.3` patch 2 CVEs	Jan 26, 2026
`7.6.0a2` pre	Jan 23, 2026
`7.6.0a1` pre	Jan 12, 2026
`7.5.2` patch 2 CVEs	Jan 12, 2026
`7.6.0a0` pre	Dec 17, 2025
`7.5.1` patch 2 CVEs	Dec 16, 2025
`7.5.0` minor 2 CVEs	Nov 19, 2025
`7.5.0rc1` pre 2 CVEs	Nov 14, 2025
`7.5.0rc0` pre 2 CVEs	Nov 03, 2025
`7.5.0b1` pre 2 CVEs	Oct 20, 2025
`7.5.0b0` pre 2 CVEs	Sep 29, 2025
`7.4.7` patch 2 CVEs	Sep 27, 2025
`7.4.6` patch 2 CVEs	Sep 26, 2025
`7.5.0a3` pre 2 CVEs	Sep 24, 2025
`7.5.0a2` pre 2 CVEs	Aug 18, 2025
`7.5.0a1` pre 2 CVEs	Aug 11, 2025
`7.4.5` patch 2 CVEs	Aug 05, 2025
`7.4.4` patch 2 CVEs	Jun 30, 2025
`7.4.3` patch 2 CVEs	May 26, 2025
`7.5.0a0` pre 2 CVEs	May 07, 2025
`7.4.2` patch 2 CVEs	May 06, 2025
`7.4.1` patch 2 CVEs	Apr 23, 2025
`7.4.0` minor 2 CVEs	Apr 09, 2025
`7.4.0rc0` pre 2 CVEs	Apr 03, 2025
`7.4.0b3` pre 2 CVEs	Mar 26, 2025
`7.4.0b2` pre 2 CVEs	Mar 20, 2025
`7.3.3` patch 2 CVEs	Mar 14, 2025
`7.4.0b1` pre 2 CVEs	Mar 14, 2025
`7.4.0b0` pre 2 CVEs	Feb 20, 2025
`7.4.0a3` pre 2 CVEs	Feb 05, 2025
`7.4.0a2` pre 2 CVEs	Feb 03, 2025
`7.4.0a1` pre 2 CVEs	Jan 07, 2025
`7.4.0a0` pre 2 CVEs	Dec 21, 2024
`7.3.2` patch 2 CVEs	Dec 21, 2024

1–50 of 212

Repository

jupyter/notebook

Forks: 5.7k
Open issues: 1.9k
Language: Jupyter Notebook
: 5.7/ 10

closember
jupyter
jupyter-notebook
notebook

Dependencies (21)

Depends on

7.6.2

Supply-chain exposure

Known CVEs (19)

CVE-2026-42557 PYSEC-2026-2681 BIT-jupyter-base-notebook-2026-42557 BIT-jupyter-notebook-2026-42557 BIT-jupyterlab-2026-42557 GHSA-mqcg-5x36-vfcg PYSEC-2026-2537 Jul 13, 2026

JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

Critical
Network Low None

JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user.

Impact

An attacker who shares a notebook or a Markdown file - via email, GitHub, or a Binder link - can invoke an arbitrary command upon a single click by the victim. The button can be rendered inside the output area and be visually indistinguishable from a legitimate widget. No kernel needs to start; the HTML output is stored in the notebook file and displayed immediately on open.

Single-click impact

An attacker convincing the victim to click on a single button or link can:

execute arbitrary code in the available kernels,

delete files leading to information loss; in principle the loss could be unrecoverable, depending on server configuration and attack complexity,

open multiple kernels/terminals at once, or create multiple files at once, putting significant stress on the server and thus deny availability for other users when using standalone multi-tenant jupyter-server deployment, and to a lesser degree impact availability on JupyterHub deployments.

The arbitrary code execution will be immediately visible to the user; and can be halted by the timely user intervention. The deletion of files can be silent and go unnoticed for some time.

Multi-click attacks

An attacker who convinces the victim to click on multiple buttons in specific order and to grant access to clipboard (or in scenarios where the user already granted keyboard access) can obtain full access to the terminal and execute arbitrary commands in the environment with access scope that might exceed that of available kernels. Only users of Chromium-based browsers are susceptible to this expanded variant of the attack.

The execution of commands in the terminal would be immediately visible to the user.

Impact of third-party extensions

The impact described above assumes a plain JupyterLab/Notebook installation. In environments with frontend extensions that contribute additional commands the attack surface is increased by the functionality covered by these commands.

Patches

JupyterLab 4.5.7

Workarounds

No workarounds are available for end-users.

Downstream applications inheriting from JupyterFrontEnd or JupyterLab can effectively disable the CommandLinker by passing commandLinker: new CommandLinker({ commands: new CommandRegistry() }) option in the initialization options.

Hardening

The patched versions include a toggle to disable the command linker functionality altogether, for example via overrides.json:

{ "@jupyterlab/apputils-extension:sanitizer": { "allowCommandLinker": false } }

Resources

https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-files

Affected versions

7.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.87.1.07.1.0a07.1.0a1

+ 57 more Show less

7.1.0a27.1.0b07.1.0rc07.1.0rc17.1.17.1.27.1.37.2.07.2.0a07.2.0b07.2.0b17.2.0rc07.2.0rc17.2.17.2.27.2.37.3.07.3.0a07.3.0a17.3.0b07.3.0b17.3.0b27.3.0rc07.3.17.3.27.3.37.4.07.4.0a07.4.0a17.4.0a27.4.0a37.4.0b07.4.0b17.4.0b27.4.0b37.4.0rc07.4.17.4.27.4.37.4.47.4.57.4.67.4.77.5.07.5.0a07.5.0a17.5.0a27.5.0a37.5.0b07.5.0b17.5.0rc07.5.0rc17.5.17.5.27.5.37.5.47.5.5

Fixed in

7.5.6

References

https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg
https://nvd.nist.gov/vuln/detail/CVE-2026-42557
https://github.com/jupyterlab/jupyterlab
https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-files
https://pypi.org/project/notebook
https://github.com/advisories/GHSA-mqcg-5x36-vfcg

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-40171 PYSEC-2026-2682 BIT-jupyter-base-notebook-2026-40171 BIT-jupyter-notebook-2026-40171 BIT-jupyterlab-2026-40171 GHSA-rch3-82jr-f9w9 PYSEC-2026-2538 Jul 13, 2026

Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

Critical
Network Low High

Impact

A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls (single click interaction).

The vulnerability enables complete account takeover through the Jupyter REST API, allowing the attacker to:

Read all files

Modify/create files

Access running kernels and execute arbitrary code

Create terminals for shell access

Patches

Jupyter Notebook 7.5.6 and JupyterLab 4.5.7 include patches for this vulnerability.

Workarounds

The help extension can be disabled via CLI:

jupyter labextension disable @jupyter-notebook/help-extension jupyter labextension disable @jupyterlab/help-extension

Hardening

The patched versions include a toggle to disable the command linker functionality altogether, for example via overrides.json:

{ "@jupyterlab/apputils-extension:sanitizer": { "allowCommandLinker": false } }

Resources

https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files

Acknowledgments

Reported by Daniel Teixeira - NVIDIA AI Red Team

Affected versions

7.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.87.1.07.1.0a07.1.0a1

+ 57 more Show less

7.1.0a27.1.0b07.1.0rc07.1.0rc17.1.17.1.27.1.37.2.07.2.0a07.2.0b07.2.0b17.2.0rc07.2.0rc17.2.17.2.27.2.37.3.07.3.0a07.3.0a17.3.0b07.3.0b17.3.0b27.3.0rc07.3.17.3.27.3.37.4.07.4.0a07.4.0a17.4.0a27.4.0a37.4.0b07.4.0b17.4.0b27.4.0b37.4.0rc07.4.17.4.27.4.37.4.47.4.57.4.67.4.77.5.07.5.0a07.5.0a17.5.0a27.5.0a37.5.0b07.5.0b17.5.0rc07.5.0rc17.5.17.5.27.5.37.5.47.5.5

Fixed in

7.5.6

References

https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9
https://nvd.nist.gov/vuln/detail/CVE-2026-40171
https://github.com/jupyter/notebook
https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files
https://pypi.org/project/notebook
https://github.com/advisories/GHSA-rch3-82jr-f9w9

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2019-10255 PYSEC-2026-2683 GHSA-rv62-4pmj-xw6h PYSEC-2026-647 Jul 09, 2026

Open Redirect vulnerability in jupyterhub and notebook

6.1 / 10
Medium
Network Low None Required Changed Low Low None

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.

Affected versions

0.0.04.0.04.0.14.0.24.0.44.0.54.0.64.1.04.2.04.2.0b14.2.14.2.2

+ 36 more Show less

4.2.34.3.04.3.14.3.24.4.04.4.15.0.05.0.0b15.0.0b25.0.0rc15.0.0rc25.1.05.1.0rc15.1.0rc25.1.0rc35.2.05.2.0rc15.2.15.2.1rc15.2.25.3.05.3.0rc15.3.15.4.05.4.15.5.05.5.0rc15.6.05.6.0rc15.7.05.7.15.7.25.7.35.7.45.7.55.7.6

Fixed in

5.7.8

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10255
https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb
https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b
https://github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed
https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4
https://github.com/advisories/GHSA-rv62-4pmj-xw6h

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-43805 PYSEC-2026-1481 BIT-jupyter-base-notebook-2024-43805 BIT-jupyter-notebook-2024-43805 BIT-jupyterlab-2024-43805 GHSA-9q39-rmj3-p4r2 PYSEC-2026-2536 Jul 07, 2026

HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

High
Network Low None None

Impact

The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.

A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.

Patches

JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2 were patched.

Workarounds

There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are:

@jupyterlab/mathjax-extension:plugin - users will loose ability to preview mathematical equations

@jupyterlab/markdownviewer-extension:plugin - users will loose ability to open Markdown previews

@jupyterlab/mathjax2-extension:plugin (if installed with optional jupyterlab-mathjax2 package) - an older version of the mathjax plugin for JupyterLab 4.x

To disable these extensions run:

jupyter labextension disable @jupyterlab/markdownviewer-extension:plugin jupyter labextension disable @jupyterlab/mathjax-extension:plugin jupyter labextension disable @jupyterlab/mathjax2-extension:plugin

To confirm that the plugins were disabled run:

jupyter labextension list

References

None

Notes

This change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (allowNamedProperties).

Affected versions

7.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.87.1.07.1.0a07.1.0a1

+ 14 more Show less

7.1.0a27.1.0b07.1.0rc07.1.0rc17.1.17.1.27.1.37.2.07.2.0a07.2.0b07.2.0b17.2.0rc07.2.0rc17.2.1

Fixed in

7.2.2

References

https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2
https://nvd.nist.gov/vuln/detail/CVE-2024-43805
https://github.com/jupyterlab/jupyterlab/commit/06ad9de836f155add7d3d651ef936cc4c5ea8093
https://github.com/jupyterlab/jupyterlab/commit/88e24baac551196f9cb3de16bd060a7ab1597674
https://github.com/jupyterlab/jupyterlab
https://pypi.org/project/jupyterlab

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-22421 PYSEC-2026-1706 BIT-jupyter-base-notebook-2024-22421 BIT-jupyter-notebook-2024-22421 BIT-jupyterlab-2024-22421 GHSA-44cc-43rp-5947 PYSEC-2026-2534 Jul 07, 2026

JupyterLab vulnerable to potential authentication and CSRF tokens leak

7.6 / 10
High
Network Low None Required Unchanged High Low Low

Impact

Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version.

Patches

JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched.

Workarounds

No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.

References

Vulnerability reported by user @davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

Affected versions

7.0.07.0.17.0.27.0.37.0.47.0.57.0.6

Fixed in

7.0.7

References

https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
https://nvd.nist.gov/vuln/detail/CVE-2024-22421
https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6
https://github.com/jupyterlab/jupyterlab/commit/1ef7a4fa0202ebdf663e1cc0b45c8813a34a0b96
https://github.com/jupyterlab/jupyterlab/commit/fccd83dc4441da0384ee3fd1322c3b2d9ad4caaa
https://github.com/jupyterlab/jupyterlab

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2024-22420 PYSEC-2026-1707 BIT-jupyter-base-notebook-2024-22420 BIT-jupyter-notebook-2024-22420 BIT-jupyterlab-2024-22420 GHSA-4m77-cmpx-vjc4 PYSEC-2026-2535 Jul 07, 2026

JupyterLab vulnerable to SXSS in Markdown Preview

6.5 / 10
Medium
Network Low None Required Unchanged High None None

Impact

The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.

A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.

Patches

JupyterLab v4.0.11 was patched.

Workarounds

Users can either disable the table of contents extension by running:

jupyter labextension disable @jupyterlab/toc-extension:registry

References

Vulnerability reported via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

Affected versions

7.0.07.0.17.0.27.0.37.0.47.0.57.0.6

Fixed in

7.0.7

References

https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4m77-cmpx-vjc4
https://nvd.nist.gov/vuln/detail/CVE-2024-22420
https://github.com/jupyterlab/jupyterlab/commit/dda0033cd49449572d077bbecd33b18d8d05f48a
https://github.com/jupyterlab/jupyterlab/commit/e1b3aabab603878e46add445a3114e838411d2df
https://github.com/jupyterlab/jupyterlab
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H

Updated Jul 13, 2026 · Source: OSV.dev
CVE-2021-32797 PYSEC-2026-688 BIT-jupyterlab-2021-32797 GHSA-4952-p58q-6crx PYSEC-2021-130 Jul 02, 2026

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

Low
Network Low None

Impact

Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.

Patches

Patched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21.

References

OWASP Page on Restricting Form Submissions

For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.

Credit: Guillaume Jeanne from Google

Affected versions

0.0.04.0.04.0.14.0.24.0.44.0.54.0.64.1.04.2.04.2.0b14.2.14.2.2

+ 57 more Show less

4.2.34.3.04.3.14.3.24.4.04.4.15.0.05.0.0b15.0.0b25.0.0rc15.0.0rc25.1.05.1.0rc15.1.0rc25.1.0rc35.2.05.2.0rc15.2.15.2.1rc15.2.25.3.05.3.0rc15.3.15.4.05.4.15.5.05.5.0rc15.6.05.6.0rc15.7.05.7.15.7.105.7.25.7.35.7.45.7.55.7.65.7.85.7.96.0.06.0.16.0.26.0.36.1.06.1.0rc16.1.16.1.26.1.36.1.46.1.56.1.66.2.06.3.06.4.06.4.0a06.4.0a16.4.0rc0

Fixed in

5.7.116.4.1

References

https://github.com/google/security-research/security/advisories/GHSA-c469-p3jp-2vhx
https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx
https://nvd.nist.gov/vuln/detail/CVE-2021-32797
https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab/PYSEC-2021-130.yaml
https://pypi.org/project/notebook

Updated Jul 06, 2026 · Source: OSV.dev
CVE-2022-29238 GHSA-v7vq-3x77-87vg BIT-jupyter-base-notebook-2022-29238 BIT-jupyter-notebook-2022-29238 PYSEC-2022-212 Jun 16, 2022

Token bruteforcing.

4.3 / 10
Medium
Network Low Low None Unchanged Low None None

Impact

What kind of vulnerability is it? Who is impacted?

Authenticated requests to the notebook server with ContentsManager.allow_hidden = False only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed.

Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. ~/.ssh while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed.

Patches

Has the problem been patched? What versions should users upgrade to?

notebook 6.4.12

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Do not run the notebook server in a directory with hidden files, use subdirectories

Use a custom ContentsManager with additional checks for self.is_hidden(path) prior to completing actions

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

Open an issue in example link to repo

Email us at example email address

Affected versions

0.0.04.0.04.0.14.0.24.0.44.0.54.0.64.1.04.2.04.2.0b14.2.14.2.2

+ 76 more Show less

4.2.34.3.04.3.14.3.24.4.04.4.15.0.05.0.0b15.0.0b25.0.0rc15.0.0rc25.1.05.1.0rc15.1.0rc25.1.0rc35.2.05.2.0rc15.2.15.2.1rc15.2.25.3.05.3.0rc15.3.15.4.05.4.15.5.05.5.0rc15.6.05.6.0rc15.7.05.7.15.7.105.7.115.7.125.7.135.7.145.7.14a05.7.155.7.165.7.25.7.35.7.45.7.55.7.65.7.85.7.96.0.06.0.0rc16.0.16.0.26.0.36.1.06.1.0rc16.1.16.1.26.1.36.1.46.1.56.1.66.2.06.3.06.4.06.4.0a06.4.0a16.4.0rc06.4.16.4.106.4.116.4.26.4.36.4.46.4.56.4.66.4.76.4.86.4.9

Fixed in

6.4.12

References

https://github.com/jupyter/notebook/security/advisories/GHSA-v7vq-3x77-87vg
https://nvd.nist.gov/vuln/detail/CVE-2022-29238
https://github.com/jupyter/notebook
https://github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2022-212.yaml

Updated Dec 06, 2023 · Source: OSV.dev
CVE-2015-7337 GHSA-92mr-v722-f48m PYSEC-2015-25 PYSEC-2015-27 May 17, 2022

Improper Input Validation in Jupyter Notebook

Critical
Network Low None None

The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.

Affected versions

4.0.04.0.14.0.24.0.4

Fixed in

4.0.5

References

https://nvd.nist.gov/vuln/detail/CVE-2015-7337
https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967
https://github.com/jupyter/notebook/commit/9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5
https://bugzilla.redhat.com/show_bug.cgi?id=1264067
https://github.com/advisories/GHSA-92mr-v722-f48m
https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2015-25.yaml

Updated Sep 20, 2024 · Source: OSV.dev
CVE-2015-6938 GHSA-4vwq-x64q-j4cj PYSEC-2015-24 PYSEC-2015-26 May 14, 2022

Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

Medium
Network Low None

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Affected versions

4.0.04.0.14.0.24.0.4

Fixed in

4.0.5

References

https://nvd.nist.gov/vuln/detail/CVE-2015-6938
https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892
https://github.com/jupyter/notebook/commit/35f32dd2da804d108a3a3585b69ec3295b2677ed
https://github.com/jupyter/notebook/commit/dd9876381f0ef09873d8c5f6f2063269172331e3
https://bugzilla.redhat.com/show_bug.cgi?id=1259405
https://github.com/advisories/GHSA-4vwq-x64q-j4cj

Updated Sep 23, 2024 · Source: OSV.dev

1–10 of 19

Insights

Releases per month

last 12 months

Release mix

major 3
minor 22
patch 92
pre 94

212 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More