CVE-2021-32798

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

References

Affected packages

Git / github.com/jupyter/notebook

Affected ranges

Type

GIT

Repo

https://github.com/jupyter/notebook

Events

Introduced

775cb20de3dc273f1fc31cd55d895e16dfe98bdf

Fixed

48018b2feaf02dfa0d9d82f86d294da6f42bf92b

Introduced

0c35002e452dcb6ca9550b2f1280235d1f04eb27

Last affected

0c35002e452dcb6ca9550b2f1280235d1f04eb27

Fixed

79fc76e890a8ec42f73a3d009e44ef84c14ef0d5

Database specific

{
    "cpe": [
        "cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:jupyter:notebook:6.4.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "5.7.0"
        },
        {
            "fixed": "5.7.11"
        },
        {
            "introduced": "6.4.0"
        },
        {
            "last_affected": "6.4.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*

5.7.0

5.7.1

5.7.10

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

6.*

6.4.0

v6.*

v6.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32798.json"

Git / github.com/jupyterlab/jupyterlab

Affected ranges

Type

GIT

Repo

https://github.com/jupyterlab/jupyterlab

Events

Introduced

8ce37a58199674b1a7a44e2f5cb059465fcef411

Last affected

8ce37a58199674b1a7a44e2f5cb059465fcef411

Database specific

{
    "cpe": "cpe:2.3:a:jupyter:notebook:6.4.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.4.0"
        },
        {
            "last_affected": "6.4.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

6.*

6.4.0

@jupyterlab/application-extension@4.*

@jupyterlab/application-extension@4.4.0

@jupyterlab/application@4.*

@jupyterlab/application@4.4.0

@jupyterlab/apputils-extension@4.*

@jupyterlab/apputils-extension@4.4.0

@jupyterlab/apputils@4.*

@jupyterlab/apputils@4.5.0

@jupyterlab/attachments@4.*

@jupyterlab/attachments@4.4.0

@jupyterlab/builder@4.*

@jupyterlab/builder@4.4.0

@jupyterlab/buildutils@4.*

@jupyterlab/buildutils@4.4.0

@jupyterlab/cell-toolbar-extension@4.*

@jupyterlab/cell-toolbar-extension@4.4.0

@jupyterlab/cell-toolbar@4.*

@jupyterlab/cell-toolbar@4.4.0

@jupyterlab/cells@4.*

@jupyterlab/cells@4.4.0

@jupyterlab/celltags-extension@4.*

@jupyterlab/celltags-extension@4.4.0

@jupyterlab/codeeditor@4.*

@jupyterlab/codeeditor@4.4.0

@jupyterlab/codemirror-extension@4.*

@jupyterlab/codemirror-extension@4.4.0

@jupyterlab/codemirror@4.*

@jupyterlab/codemirror@4.4.0

@jupyterlab/completer-extension@4.*

@jupyterlab/completer-extension@4.4.0

@jupyterlab/completer@4.*

@jupyterlab/completer@4.4.0

@jupyterlab/console-extension@4.*

@jupyterlab/console-extension@4.4.0

@jupyterlab/console@4.*

@jupyterlab/console@4.4.0

@jupyterlab/coreutils@6.*

@jupyterlab/coreutils@6.4.0

@jupyterlab/csvviewer-extension@4.*

@jupyterlab/csvviewer-extension@4.4.0

@jupyterlab/csvviewer@4.*

@jupyterlab/csvviewer@4.4.0

@jupyterlab/debugger-extension@4.*

@jupyterlab/debugger-extension@4.4.0

@jupyterlab/debugger@4.*

@jupyterlab/debugger@4.4.0

@jupyterlab/docmanager-extension@4.*

@jupyterlab/docmanager-extension@4.4.0

@jupyterlab/docmanager@4.*

@jupyterlab/docmanager@4.4.0

@jupyterlab/docregistry@4.*

@jupyterlab/docregistry@4.4.0

@jupyterlab/documentsearch-extension@4.*

@jupyterlab/documentsearch-extension@4.4.0

@jupyterlab/documentsearch@4.*

@jupyterlab/documentsearch@4.4.0

@jupyterlab/extensionmanager-extension@4.*

@jupyterlab/extensionmanager-extension@4.4.0

@jupyterlab/extensionmanager@4.*

@jupyterlab/extensionmanager@4.4.0

@jupyterlab/filebrowser-extension@4.*

@jupyterlab/filebrowser-extension@4.4.0

@jupyterlab/filebrowser@4.*

@jupyterlab/filebrowser@4.4.0

@jupyterlab/fileeditor-extension@4.*

@jupyterlab/fileeditor-extension@4.4.0

@jupyterlab/fileeditor@4.*

@jupyterlab/fileeditor@4.4.0

@jupyterlab/galata@5.*

@jupyterlab/galata@5.4.0

@jupyterlab/help-extension@4.*

@jupyterlab/help-extension@4.4.0

@jupyterlab/htmlviewer-extension@4.*

@jupyterlab/htmlviewer-extension@4.4.0

@jupyterlab/htmlviewer@4.*

@jupyterlab/htmlviewer@4.4.0

@jupyterlab/hub-extension@4.*

@jupyterlab/hub-extension@4.4.0

@jupyterlab/imageviewer-extension@4.*

@jupyterlab/imageviewer-extension@4.4.0

@jupyterlab/imageviewer@4.*

@jupyterlab/imageviewer@4.4.0

@jupyterlab/inspector-extension@4.*

@jupyterlab/inspector-extension@4.4.0

@jupyterlab/inspector@4.*

@jupyterlab/inspector@4.4.0

@jupyterlab/javascript-extension@4.*

@jupyterlab/javascript-extension@4.4.0

@jupyterlab/json-extension@4.*

@jupyterlab/json-extension@4.4.0

@jupyterlab/launcher-extension@4.*

@jupyterlab/launcher-extension@4.4.0

@jupyterlab/launcher@4.*

@jupyterlab/launcher@4.4.0

@jupyterlab/logconsole-extension@4.*

@jupyterlab/logconsole-extension@4.4.0

@jupyterlab/logconsole@4.*

@jupyterlab/logconsole@4.4.0

@jupyterlab/lsp-extension@4.*

@jupyterlab/lsp-extension@4.4.0

@jupyterlab/lsp@4.*

@jupyterlab/lsp@4.4.0

@jupyterlab/mainmenu-extension@4.*

@jupyterlab/mainmenu-extension@4.4.0

@jupyterlab/mainmenu@4.*

@jupyterlab/mainmenu@4.4.0

@jupyterlab/markdownviewer-extension@4.*

@jupyterlab/markdownviewer-extension@4.4.0

@jupyterlab/markdownviewer@4.*

@jupyterlab/markdownviewer@4.4.0

@jupyterlab/markedparser-extension@4.*

@jupyterlab/markedparser-extension@4.4.0

@jupyterlab/mathjax-extension@4.*

@jupyterlab/mathjax-extension@4.4.0

@jupyterlab/mermaid-extension@4.*

@jupyterlab/mermaid-extension@4.4.0

@jupyterlab/mermaid@4.*

@jupyterlab/mermaid@4.4.0

@jupyterlab/metadataform-extension@4.*

@jupyterlab/metadataform-extension@4.4.0

@jupyterlab/metadataform@4.*

@jupyterlab/metadataform@4.4.0

@jupyterlab/metapackage@4.*

@jupyterlab/metapackage@4.4.0

@jupyterlab/nbconvert-css@4.*

@jupyterlab/nbconvert-css@4.4.0

@jupyterlab/nbformat@4.*

@jupyterlab/nbformat@4.4.0

@jupyterlab/notebook-extension@4.*

@jupyterlab/notebook-extension@4.4.0

@jupyterlab/notebook@4.*

@jupyterlab/notebook@4.4.0

@jupyterlab/observables@5.*

@jupyterlab/observables@5.4.0

@jupyterlab/outputarea@4.*

@jupyterlab/outputarea@4.4.0

@jupyterlab/pdf-extension@4.*

@jupyterlab/pdf-extension@4.4.0

@jupyterlab/pluginmanager-extension@4.*

@jupyterlab/pluginmanager-extension@4.4.0

@jupyterlab/pluginmanager@4.*

@jupyterlab/pluginmanager@4.4.0

@jupyterlab/property-inspector@4.*

@jupyterlab/property-inspector@4.4.0

@jupyterlab/rendermime-extension@4.*

@jupyterlab/rendermime-extension@4.4.0

@jupyterlab/rendermime-interfaces@3.*

@jupyterlab/rendermime-interfaces@3.12.0

@jupyterlab/rendermime@4.*

@jupyterlab/rendermime@4.4.0

@jupyterlab/running-extension@4.*

@jupyterlab/running-extension@4.4.0

@jupyterlab/running@4.*

@jupyterlab/running@4.4.0

@jupyterlab/services-extension@4.*

@jupyterlab/services-extension@4.4.0

@jupyterlab/services@7.*

@jupyterlab/services@7.4.0

@jupyterlab/settingeditor-extension@4.*

@jupyterlab/settingeditor-extension@4.4.0

@jupyterlab/settingeditor@4.*

@jupyterlab/settingeditor@4.4.0

@jupyterlab/settingregistry@4.*

@jupyterlab/settingregistry@4.4.0

@jupyterlab/shortcuts-extension@5.*

@jupyterlab/shortcuts-extension@5.2.0

@jupyterlab/statedb@4.*

@jupyterlab/statedb@4.4.0

@jupyterlab/statusbar-extension@4.*

@jupyterlab/statusbar-extension@4.4.0

@jupyterlab/statusbar@4.*

@jupyterlab/statusbar@4.4.0

@jupyterlab/template@4.*

@jupyterlab/template@4.4.0

@jupyterlab/terminal-extension@4.*

@jupyterlab/terminal-extension@4.4.0

@jupyterlab/terminal@4.*

@jupyterlab/terminal@4.4.0

@jupyterlab/testing@4.*

@jupyterlab/testing@4.4.0

@jupyterlab/testutils@4.*

@jupyterlab/testutils@4.4.0

@jupyterlab/theme-dark-extension@4.*

@jupyterlab/theme-dark-extension@4.4.0

@jupyterlab/theme-dark-high-contrast-extension@4.*

@jupyterlab/theme-dark-high-contrast-extension@4.4.0

@jupyterlab/theme-light-extension@4.*

@jupyterlab/theme-light-extension@4.4.0

@jupyterlab/toc-extension@6.*

@jupyterlab/toc-extension@6.4.0

@jupyterlab/toc@6.*

@jupyterlab/toc@6.4.0

@jupyterlab/tooltip-extension@4.*

@jupyterlab/tooltip-extension@4.4.0

@jupyterlab/tooltip@4.*

@jupyterlab/tooltip@4.4.0

@jupyterlab/translation-extension@4.*

@jupyterlab/translation-extension@4.4.0

@jupyterlab/translation@4.*

@jupyterlab/translation@4.4.0

@jupyterlab/ui-components-extension@4.*

@jupyterlab/ui-components-extension@4.4.0

@jupyterlab/ui-components@4.*

@jupyterlab/ui-components@4.4.0

@jupyterlab/vega5-extension@4.*

@jupyterlab/vega5-extension@4.4.0

@jupyterlab/workspaces-extension@4.*

@jupyterlab/workspaces-extension@4.4.0

@jupyterlab/workspaces@4.*

@jupyterlab/workspaces@4.4.0

v4.*

v4.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32798.json"