Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

jupyter-notebook

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1PyPIAmendedPublished

    Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

    CVE-2019-9644 · GHSA-hhx8-cr55-qcxx

    Affected
    • PyPI jupyter-notebook <= 5.7.5
    Fixed in
    5.7.6· Vendor fix available
    Issue
    An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.

    Recommended action: Upgrade to 5.7.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →