Login Request a demo
Medium severity · published Mar 12, 2019
CVE-2019-9644
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a…
5.4
CVSS
1.5%
EPSS
No
On KEV
Description
An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Notebook · Jupyter
before 5.7.6 · source: NVD
Affected product
NO
Notebook
Jupyter
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-9644
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-9644
Patch
https://github.com/jupyter/notebook/compare/f3f00df...05aa4b2
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO/
More from Notebook
9.6
CVE-2026-42557
jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
9.6
CVE-2021-32798
The Jupyter notebook is a web-based notebook environment for interactive computing
8.4
CVE-2026-40171
Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
7.8
CVE-2018-8768
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context
7.5
CVE-2022-24758
The Jupyter notebook is a web-based notebook environment for interactive computing