# notebook (PyPI) vulnerabilities 21 known vulnerabilities (1 critical, 7 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 7.7M - Dependents: 3,030 - Registry: https://pypi.org/project/notebook/ ## Advisories (21) ### [CVE-2026-102832](https://cve.now/CVE-2026-102832): JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked - Severity: Medium 4.2 - Published: Oct 13, 2026 - Affected: from 7.5.6, fixed in 7.6.3. ### [CVE-2026-102831](https://cve.now/CVE-2026-102831): JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard - Severity: High 8.1 - Published: Sep 29, 2026 - Affected: from 7.5.0, fixed in 7.6.3; from 7.5.0, fixed in 7.6.3. ### [CVE-2026-42557](https://cve.now/CVE-2026-42557): jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content - Severity: High 8.6 - Published: May 13, 2026 - Affected: from 7.0.0, fixed in 7.5.6. ### [CVE-2026-40171](https://cve.now/CVE-2026-40171): Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker - Severity: High 8.4 - Published: May 6, 2026 - Affected: from 7.0.0, fixed in 7.5.6. ### [CVE-2024-43805](https://cve.now/CVE-2024-43805): HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering - Severity: High 7.6 - Published: Aug 28, 2024 - Affected: from 7.0.0, fixed in 7.2.2. ### [CVE-2024-22420](https://cve.now/CVE-2024-22420): Stored cross site scripting in Markdown Preview in JupyterLab - Severity: Medium 6.5 - Published: Jan 19, 2024 - Affected: from 7.0.0, fixed in 7.0.7. ### [CVE-2024-22421](https://cve.now/CVE-2024-22421): Potential authentication and CSRF tokens leak in JupyterLab - Severity: High 7.6 - Published: Jan 19, 2024 - Affected: from 7.0.0, fixed in 7.0.7. ### [CVE-2022-29238](https://cve.now/CVE-2022-29238): Forced Browsing in Jupyter Notebook - Severity: Medium 4.3 - Published: Jun 14, 2022 - Affected: fixed in 6.4.12; fixed in 6.4.12. ### [CVE-2022-24758](https://cve.now/CVE-2022-24758): Insertion of Sensitive Information into Log File affects Jupyter Notebook - Severity: High 7.5 - Published: Mar 31, 2022 - Affected: fixed in 6.4.10; fixed in 6.4.10. ### [CVE-2021-32798](https://cve.now/CVE-2021-32798): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook - Severity: Critical 10.0 - Published: Aug 9, 2021 - Affected: from 5.7.0, fixed in 5.7.11; fixed in 5.7.11; from 6.0.0, fixed in 6.4.1. ### [CVE-2021-32797](https://cve.now/CVE-2021-32797): JupyterLab: XSS due to lack of sanitization of the action attribute of an html \ - Severity: High 7.4 - Published: Aug 9, 2021 - Affected: fixed in 5.7.11; from 6.0.0, fixed in 6.4.1; fixed in 5.7.11; from 6.0.0, fixed in 6.4.1. ### [CVE-2020-26215](https://cve.now/CVE-2020-26215): Open redirect in Jupyter Notebook - Severity: Medium 4.4 - Published: Nov 18, 2020 - Affected: fixed in 6.1.5; fixed in 6.1.5. ### [CVE-2018-21030](https://cve.now/CVE-2018-21030): Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. - Severity: Unrated - Published: Oct 31, 2019 - Affected: fixed in 5.5.0; fixed in 5.5.0rc1. ### [CVE-2019-10856](https://cve.now/CVE-2019-10856): In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. - Severity: Unrated - Published: Apr 4, 2019 - Affected: fixed in 5.7.8. ### [CVE-2019-10255](https://cve.now/CVE-2019-10255): An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before… - Severity: Unrated - Published: Mar 28, 2019 - Affected: fixed in 5.7.8. ### [CVE-2019-9644](https://cve.now/CVE-2019-9644): An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when… - Severity: Unrated - Published: Mar 12, 2019 - Affected: fixed in 5.7.6. ### [CVE-2018-19352](https://cve.now/CVE-2018-19352): Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs… - Severity: Unrated - Published: Nov 18, 2018 - Affected: fixed in 5.7.2. ### [CVE-2018-19351](https://cve.now/CVE-2018-19351): Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as… - Severity: Unrated - Published: Nov 18, 2018 - Affected: fixed in 5.7.1. ### [CVE-2018-8768](https://cve.now/CVE-2018-8768): In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. - Severity: Unrated - Published: Mar 18, 2018 - Affected: fixed in 5.4.1. ### [CVE-2015-7337](https://cve.now/CVE-2015-7337): The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary… - Severity: Unrated - Published: Sep 29, 2015 - Affected: from 4.0.0, fixed in 4.0.5. ### [CVE-2015-6938](https://cve.now/CVE-2015-6938): Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter… - Severity: Unrated - Published: Sep 21, 2015 - Affected: from 4.0.0, fixed in 4.0.5. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/notebook Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.