Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

notebook

21 known vulnerabilities (1 critical, 7 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
21 · 1 critical, 7 high, 4 medium
Weekly downloads
7.7M
Dependents
3,030
Registry
PyPI

Advisories 21

  • CVE-2026-102832Medium 4.2

    JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

    Affected: from 7.5.6, fixed in 7.6.3.

  • JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

    Affected: from 7.5.0, fixed in 7.6.3; from 7.5.0, fixed in 7.6.3.

  • jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

    Affected: from 7.0.0, fixed in 7.5.6.

  • Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker

    Affected: from 7.0.0, fixed in 7.5.6.

  • HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

    Affected: from 7.0.0, fixed in 7.2.2.

  • CVE-2024-22420Medium 6.5

    Stored cross site scripting in Markdown Preview in JupyterLab

    Affected: from 7.0.0, fixed in 7.0.7.

  • Potential authentication and CSRF tokens leak in JupyterLab

    Affected: from 7.0.0, fixed in 7.0.7.

  • CVE-2022-29238Medium 4.3

    Forced Browsing in Jupyter Notebook

    Affected: fixed in 6.4.12; fixed in 6.4.12.

  • Insertion of Sensitive Information into Log File affects Jupyter Notebook

    Affected: fixed in 6.4.10; fixed in 6.4.10.

  • CVE-2021-32798Critical 10.0

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook

    Affected: from 5.7.0, fixed in 5.7.11; fixed in 5.7.11; from 6.0.0, fixed in 6.4.1.

  • JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

    Affected: fixed in 5.7.11; from 6.0.0, fixed in 6.4.1; fixed in 5.7.11; from 6.0.0, fixed in 6.4.1.

  • CVE-2020-26215Medium 4.4

    Open redirect in Jupyter Notebook

    Affected: fixed in 6.1.5; fixed in 6.1.5.

  • Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin.

    Affected: fixed in 5.5.0; fixed in 5.5.0rc1.

  • In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc.

    Affected: fixed in 5.7.8.

  • An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before…

    Affected: fixed in 5.7.8.

Show all 21 advisoriesShow fewer advisories

  • An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when…

    Affected: fixed in 5.7.6.

  • Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs…

    Affected: fixed in 5.7.2.

  • Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as…

    Affected: fixed in 5.7.1.

  • In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context.

    Affected: fixed in 5.4.1.

  • The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary…

    Affected: from 4.0.0, fixed in 4.0.5.

  • Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter…

    Affected: from 4.0.0, fixed in 4.0.5.