PyPI/notebook CVE-2018-21030: medium 5.3, EPSS 1.44%

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.

Action: Upgrade notebook to 5.5.0 or later.

pip install notebook==5.5.0

Affected

Fixed versions

Sources

• osv: PYSEC-2019-157
• nvd: CVE-2018-21030
• https://github.com/jupyter/notebook/releases/tag/5.5.0
• https://github.com/jupyter/notebook/pull/3341
• https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
• https://github.com/advisories/GHSA-jqwc-jm56-wcwj

CVE-2018-21030 · published 2019-10-31T15:15:00Z · modified 2023-11-08T04:00:14.113021Z · JSON