PyPI/notebook CVE-2018-19351: unknown, EPSS 1.51%
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can ex
Action: Upgrade notebook to 5.7.1 or later.
pip install notebook==5.7.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.7.1 | - |
Fixed versions
| 5.7.1 |
Sources
- osv: PYSEC-2018-17
- https://pypi.org/project/notebook/#history
- https://groups.google.com/forum/#!topic/jupyter/hWzu2BSsplY
- https://github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491
- https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
- https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
- https://github.com/advisories/GHSA-49qr-xh3w-h436
CVE-2018-19351 · published · modified · JSON