Medium severity · published Nov 18, 2018
CVE-2018-19351
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server
6.1
CVSS
1.5%
EPSS
No
On KEV
Description
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Notebook · Jupyter
before 5.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-19351
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-19351
Release Notes
https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
Patch
https://github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491
groups.google.com
https://groups.google.com/forum/#%21topic/jupyter/hWzu2BSsplY
lists.debian.org
https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
Third Party Advisory
https://pypi.org/project/notebook/#history
More from Notebook
9.6
CVE-2026-42557
jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
9.6
CVE-2021-32798
The Jupyter notebook is a web-based notebook environment for interactive computing
8.4
CVE-2026-40171
Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
7.8
CVE-2018-8768
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context
7.5
CVE-2022-24758
The Jupyter notebook is a web-based notebook environment for interactive computing