Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
GHSA-hhx8-cr55-qcxx · CVE-2019-9644 · PYSEC-2019-159 · PYSEC-2026-2531
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-9644
- PACKAGE https://github.com/jupyter/notebook
- WEB https://github.com/jupyter/notebook/compare/f3f00df...05aa4b2
- WEB https://github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2019-159.yaml
- WEB https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D
- WEB https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO
Ready to move
Start Securing
Free, no credit card | First findings in minutes