GitHub Advisoryadvisory · PyPI

GHSA-6cwv-x26c-w2q4 Jupyter Notebook file bypasses sanitization, executes JavaScript

HIGH Published 2018-07-12 Modified 2024-09-27 Official page ↗
Aliases
CVE-2018-8768
Ecosystem
PyPI
Packages
notebook
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Reviewed
2020-06-16

Affected packages

• PyPI notebook: < 5.4.1 → fixed in 5.4.1

Description

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

Related

Alias · CVE (1)

  • CVE-2018-8768 In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. vulnerability

References