CVE-2018-8768
Summary
| CVE | CVE-2018-8768 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-03-18 06:29:00 UTC |
| Updated | 2020-11-19 07:15:00 UTC |
| Description | In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA 2432-1] jupyter-notebook security update | MLIST | lists.debian.org | |
| oss-security - CVE request: maliciously crafted notebook files in Jupyter | CONFIRM | openwall.com | Mailing List, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981273 Python (pip) Security Update for notebook (GHSA-6cwv-x26c-w2q4)