CVE-2020-26215

CVE-2020-26215 affects Jupyter Notebook up to version 6.1.4, which is vulnerable to an open redirect via a specially crafted link to a notebook server that redirects the user to a spoofed website. The issue enables phishing-like redirection to arbitrary websites on the public internet. The vulner...

CVE-2022-24758

CVE-2022-24758 affects Jupyter Notebook. The issue arises from logging: when a 5xx error occurs, auth cookies and other header values are recorded in server logs, potentially exposing sensitive information to anyone with log access. This vulnerability is described as affecting Jupyter Notebook pr...

CVE-2022-29238

CVE-2022-29238 affects Jupyter Notebook prior to 6.4.12, where authenticated requests to the notebook server could access files that are hidden but not inaccessible when ContentsManager.allow_hidden = False is used. The underlying issue is that hidden files/directories could be read if their name...

CVE-2021-32798

CVE-2021-32798 affects Jupyter Notebook. An untrusted notebook can execute code on load due to a Google Caja sanitization bypass, enabling a cross-site scripting (XSS) condition that could let an attacker run code via the victim’s Jupyter APIs after opening a crafted ipynb. Public disclosures ind...

CVE-2015-6938

CVE-2015-6938 describes an XSS in the file browser of IPython Notebook/Jupyter Notebook. Affected products are IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5, where a folder name in the file browser notebook/notebookapp.py can be crafted to inject arbitrary web script or HT...

CVE-2018-8768

CVE-2018-8768 affects Jupyter Notebook up to version 5.4.1. A maliciously forged notebook can bypass sanitization, allowing JavaScript execution in the notebook context due to how invalid HTML is fixed by jQuery after sanitization (XSS risk). The issue is documented in multiple advisories (Debian...

CVE-2019-10255

CVE-2019-10255 affects Jupyter Notebook and JupyterHub: an open redirect vulnerability allows crafted links to redirect to a malicious site after login. Affected: Jupyter Notebook before 5.7.7 and JupyterHub before 0.9.5 (base description). Public details in connected docs indicate the issue is a...

CVE-2024-43805

CVE-2024-43805 affects JupyterLab and Jupyter Notebook where a user opens a malicious notebook or Markdown file in preview mode can lead to data access and arbitrary requests performed as the attacked user. Affected versions include JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2; patches e...

CVE-2019-10856

Technical details about CVE-2019-10856 (affected products, root cause, impact, fixes) are not provided in the supplied connected documents; please monitor official advisories for updates.

CVE-2019-9644

Jupyter Notebook before 5.7.6 is affected by an XSSI vulnerability that allows inclusion of resources on malicious pages when users are authenticated to a Jupyter server. The issue arises from improper handling of cross-site script inclusion and can lead to exposure of resource contents (notably ...

CVE-2018-19351

CVE-2018-19351 affects Jupyter Notebook prior to 5.7.2 due to missing Content Security Policy in nbconvert endpoints, enabling XSS via untrusted notebooks. Connected advisories confirm upstream fix in 5.7.2 (and related CSP/Open-redirect issues), with Debian/Fedora/Arch/Mageia/Ubuntu advisories r...

CVE-2018-21030

CVE-2018-21030 affects Jupyter Notebook prior to 5.5.0. The issue is that a lack of a Content Security Policy (CSP) header allows cross-origin risks, enabling XSS via SVG documents embedded in served files. The vulnerability is fixed in Jupyter Notebook 5.5.0; upgrade to 5.5.0 or newer to mitigat...

CVE-2018-19352

The CVE-2018-19352 issue affects Jupyter Notebook prior to 5.7.2. The root cause is unsafe handling in the tree view, specifically crafted directory names (in notebook/static/tree/js/notebooklist.js) that allow cross‑site scripting. Impact per the sources: a remote attacker can execute JavaScript...

CVE-2024-22421

CVE-2024-22421 affects JupyterLab and relates to a redirect vulnerability in older jupyter-server versions. If a user clicks a malicious link, their Authorization and XSRFToken can be exposed to a third party when running vulnerable jupyter-server. Affected JupyterLab releases are 4.1.0b2, 4.0.11...

CVE-2015-7337

CVE-2015-7337 — IPython Notebook/Jupyter Notebook MIME-type handling flaw . The vulnerability affects IPython Notebook versions before 3.2.2 and Jupyter Notebook versions before 4.0.5, where a crafted file can trigger a redirect to files/ and cause remote JavaScript execution. Root cause: imprope...

CVE-2024-22420

CVE-2024-22420 affects JupyterLab; the vulnerability arises when a user opens a malicious Markdown file via the Markdown Preview feature, allowing the attacker to access the attacked user’s data and perform arbitrary requests as that user. According to connected sources, impact is limited to data...

CVE-2026-42557

CVE-2026-42557 affects JupyterLab prior to 4.5.7. The HTML sanitizer allowedlist for button elements included data-commandlinker-command and data-commandlinker-args, while CommandLinker listens for all click events on document.body and may execute the named command without validating the source U...