MEDIUM 6.1 PyPI
Jupyter Notebook XSS via untrusted notebooks
GHSA-49qr-xh3w-h436 · CVE-2018-19351 · PYSEC-2018-17
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2018-19351
- WEB https://github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491
- PACKAGE https://github.com/jupyter/notebook
- WEB https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
- WEB https://github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2018-17.yaml
- WEB https://groups.google.com/forum/#!topic/jupyter/hWzu2BSsplY
- WEB https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
- WEB https://pypi.org/project/notebook/#history
Ready to move
Start Securing
Free, no credit card | First findings in minutes