Description
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jupyter | notebook | >= 6.0.0, < 6.4.1, < 5.7.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jupyter-notebook | 6.4.3-1 | — |
| Debian 13 | jupyter-notebook | 6.4.3-1 | — |
| Debian 12 | jupyter-notebook | 6.4.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jupyter-notebook | No fix yet | — |
| Ubuntu 18.04 LTS | jupyter-notebook | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | python-notebook | 5.7.11-bp156.4.3.1 | openSUSE-SU-2024:0231-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | python-notebook | 5.7.11-bp156.4.3.1 | openSUSE-SU-2024:0231-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | notebook | < 5.7.11 | 5.7.11 | GHSA-hwvq-6gjx-j797 |
| PyPI | notebook | >= 6.0.0, < 6.4.1 | 6.4.1 | GHSA-hwvq-6gjx-j797 |
| PyPI | notebook | >= 5.7.0, < 5.7.11 | 5.7.11 | PYSEC-2021-118 |
Advisories 1
- openSUSE-SU-2024:0231-1 Security update for python-notebook SUSE / openSUSE Security Updates · Feb 4, 2026