CVE-2018-19351
Summary
| CVE | CVE-2018-19351 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-11-18 17:29:00 UTC |
| Updated | 2023-11-07 02:55:00 UTC |
| Description | Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA 2432-1] jupyter-notebook security update | MLIST | lists.debian.org | |
| Google Groups | groups.google.com | ||
| Google Groups | MISC | groups.google.com | Issue Tracking, Third Party Advisory |
| Page not found · GitHub · GitHub | MISC | github.com | Release Notes |
| Apply CSP sandboxing for nbconvert responses · jupyter/notebook@107a89f · GitHub | MISC | github.com | Patch, Third Party Advisory |
| notebook · PyPI | MISC | pypi.org | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.