CVE-2021-32798

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

References

Affected packages

Git / github.com/jupyter/notebook

Affected ranges

Type

GIT

Repo

https://github.com/jupyter/notebook

Events

Introduced

775cb20de3dc273f1fc31cd55d895e16dfe98bdf

Fixed

48018b2feaf02dfa0d9d82f86d294da6f42bf92b

Introduced

Last affected

0c35002e452dcb6ca9550b2f1280235d1f04eb27

Fixed

79fc76e890a8ec42f73a3d009e44ef84c14ef0d5

Database specific

{
    "versions": [
        {
            "introduced": "5.7.0"
        },
        {
            "fixed": "5.7.11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.4.0"
        }
    ]
}

Affected versions

5.*

5.7.0

5.7.1

5.7.10

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

6.*

6.0.0

6.0.0rc1

6.0.1

6.0.2

6.0.3

6.1.0

6.1.0rc1

6.1.1

6.1.2

6.1.3

6.1.4

6.2.0

6.3.0

v6.*

v6.4.0

v6.4.0rc0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32798.json"