CVE-2020-26215

CVE-2020-26215 affects Jupyter Notebook up to version 6.1.4, which is vulnerable to an open redirect via a specially crafted link to a notebook server that redirects the user to a spoofed website. The issue enables phishing-like redirection to arbitrary websites on the public internet. The vulner...

CVE-2022-24758

CVE-2022-24758 affects Jupyter Notebook. The issue arises from logging: when a 5xx error occurs, auth cookies and other header values are recorded in server logs, potentially exposing sensitive information to anyone with log access. This vulnerability is described as affecting Jupyter Notebook pr...

CVE-2022-29238

CVE-2022-29238 affects Jupyter Notebook prior to 6.4.12, where authenticated requests to the notebook server could access files that are hidden but not inaccessible when ContentsManager.allow_hidden = False is used. The underlying issue is that hidden files/directories could be read if their name...

CVE-2018-8768

CVE-2018-8768 affects Jupyter Notebook up to version 5.4.1. A maliciously forged notebook can bypass sanitization, allowing JavaScript execution in the notebook context due to how invalid HTML is fixed by jQuery after sanitization (XSS risk). The issue is documented in multiple advisories (Debian...

CVE-2019-10856

Technical details about CVE-2019-10856 (affected products, root cause, impact, fixes) are not provided in the supplied connected documents; please monitor official advisories for updates.

CVE-2019-10255

CVE-2019-10255 affects Jupyter Notebook and JupyterHub: an open redirect vulnerability allows crafted links to redirect to a malicious site after login. Affected: Jupyter Notebook before 5.7.7 and JupyterHub before 0.9.5 (base description). Public details in connected docs indicate the issue is a...

CVE-2019-9644

Jupyter Notebook before 5.7.6 is affected by an XSSI vulnerability that allows inclusion of resources on malicious pages when users are authenticated to a Jupyter server. The issue arises from improper handling of cross-site script inclusion and can lead to exposure of resource contents (notably ...

CVE-2018-19351

CVE-2018-19351 affects Jupyter Notebook prior to 5.7.2 due to missing Content Security Policy in nbconvert endpoints, enabling XSS via untrusted notebooks. Connected advisories confirm upstream fix in 5.7.2 (and related CSP/Open-redirect issues), with Debian/Fedora/Arch/Mageia/Ubuntu advisories r...

CVE-2018-21030

CVE-2018-21030 affects Jupyter Notebook prior to 5.5.0. The issue is that a lack of a Content Security Policy (CSP) header allows cross-origin risks, enabling XSS via SVG documents embedded in served files. The vulnerability is fixed in Jupyter Notebook 5.5.0; upgrade to 5.5.0 or newer to mitigat...

CVE-2018-19352

The CVE-2018-19352 issue affects Jupyter Notebook prior to 5.7.2. The root cause is unsafe handling in the tree view, specifically crafted directory names (in notebook/static/tree/js/notebooklist.js) that allow cross‑site scripting. Impact per the sources: a remote attacker can execute JavaScript...