VDB
DEBIAN-CVE-2018-19351
DEBIAN-CVE-2018-19351
PUBLISHED
CVSS 6.099999904632568 MEDIUM
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
Risk Scores
CVSS 3.0
6.099999904632568
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | jupyter-notebook | 0 |
| Debian:14 | jupyter-notebook | 0 |
| Debian:13 | jupyter-notebook | 0 |
Timeline
- Nov 18, 2018 CVE Published
- Oct 23, 2026 CVE Updated