PyPI/nbgrader CVE-2025-23205: medium 6.9, EPSS 0.49%
nbgrader's `frame-ancestors: self` grants all users access to formgrader
Action: Upgrade nbgrader to 0.9.5 or later.
pip install nbgrader==0.9.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.9.4 | 0.9.5 | - |
Fixed versions
| 0.9.5 |
Sources
- osv: PYSEC-2026-1692
- nvd: CVE-2025-23205
- https://github.com/jupyter/nbgrader/security/advisories/GHSA-fcr8-4r9f-r66m
- https://github.com/jupyter/nbgrader/pull/1915
- https://github.com/jupyter/nbgrader/commit/73e137511ac1dc02e95790d4fd6d4d88dab42325
- https://github.com/jupyter/nbgrader
- https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html
- https://pypi.org/project/nbgrader
- https://github.com/advisories/GHSA-fcr8-4r9f-r66m
CVE-2025-23205 · published · modified · JSON