Skip to content
OpenAdvisories
High USN-5585-1 8 CVEs

jupyter-notebook vulnerabilities

Published Aug 30, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Jupyter Notebook incorrectly handled certain notebooks.
An attacker could possibly use this issue of lack of Content Security Policy
in Nbconvert to perform cross-site scripting (XSS) attacks on the notebook
server. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19351)

It was discovered that Jupyter Notebook incorrectly handled certain SVG
documents. An attacker could possibly use this issue to perform cross-site
scripting (XSS) attacks. This issue only affected Ubuntu 18.04 LTS.
(CVE-2018-21030)

It was discovered that Jupyter Notebook incorrectly filtered certain URLs on
the login page. An attacker could possibly use this issue to perform
open-redirect attack. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-10255)

It was discovered that Jupyter Notebook had an incomplete fix for
CVE-2019-10255. An attacker could possibly use this issue to perform
open-redirect attack using empty netloc. (CVE-2019-10856)

It was discovered that Jupyter Notebook incorrectly handled the inclusion of
remote pages on Jupyter server. An attacker could possibly use this issue to
perform cross-site script inclusion (XSSI) attacks. This issue only affected
Ubuntu 18.04 LTS. (CVE-2019-9644)

It was discovered that Jupyter Notebook incorrectly filtered certain URLs to a
notebook. An attacker could possibly use this issue to perform open-redirect
attack. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-26215)

It was discovered that Jupyter Notebook server access logs were not protected.
An attacker having access to the notebook server could possibly use this issue
to get access to steal sensitive information such as auth/cookies.
(CVE-2022-24758)

It was discovered that Jupyter Notebook incorrectly configured hidden files on
the server. An authenticated attacker could possibly use this issue to see
unwanted sensitive hidden files from the server which may result in getting
full access to the server. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2022-29238)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS jupyter-notebook 5.2.2-1ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS jupyter-notebook 6.0.3-2ubuntu0.1
Ubuntu · 22.04 LTS 22.04:LTS jupyter-notebook 6.4.8-1ubuntu0.1

Vulnerabilities 8

  • High 7.5
    CVE-2022-24758

    Insertion of Sensitive Information into Log File affects Jupyter Notebook

    The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are re…

    jupyter notebook notebook jupyter-notebook Debian Ubuntu Alpine PyPI
  • Medium 6.1
    CVE-2018-19351

    Jupyter Notebook XSS via untrusted notebooks

    Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook…

    notebook jupyter-notebook jupyter-notebook Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2019-10255

    Open Redirect vulnerability in jupyterhub and notebook

    An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers run…

    notebook jupyter-notebook jupyter-notebook jupyterhub Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2019-10856

    Jupyter Notebook open redirect vulnerability

    In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255.

    notebook jupyter-notebook Ubuntu PyPI
  • Medium 5.4
    CVE-2019-9644

    Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

    An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Int…

    notebook jupyter-notebook jupyter-notebook jupyter-notebook Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2018-21030

    Cross-site scripting in Jupyter Notebook

    Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.

    notebook jupyter-notebook jupyter-notebook Debian Ubuntu PyPI
  • Medium 4.4
    CVE-2020-26215

    Open redirect in Jupyter Notebook

    Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted link…

    jupyter notebook notebook jupyter-notebook Debian Ubuntu PyPI
  • Medium 4.3
    CVE-2022-29238

    Forced Browsing in Jupyter Notebook

    Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not a…

    jupyter notebook notebook jupyter-notebook Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2018-19351
  • report
    https://ubuntu.com/security/CVE-2018-21030
  • report
    https://ubuntu.com/security/CVE-2019-9644
  • report
    https://ubuntu.com/security/CVE-2019-10255
  • report
    https://ubuntu.com/security/CVE-2019-10856
  • report
    https://ubuntu.com/security/CVE-2020-26215
  • report
    https://ubuntu.com/security/CVE-2022-24758
  • report
    https://ubuntu.com/security/CVE-2022-29238