Vulnerability Details CVE-2021-32798
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.7%
CVSS Severity
CVSS v3 Score 10.0
CVSS v2 Score 6.8
References
- https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5
- https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797
- https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5
- https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797
Products affected by CVE-2021-32798
-
cpe:2.3:a:jupyter:notebook:5.7.0
-
cpe:2.3:a:jupyter:notebook:5.7.1
-
cpe:2.3:a:jupyter:notebook:5.7.10
-
cpe:2.3:a:jupyter:notebook:5.7.2
-
cpe:2.3:a:jupyter:notebook:5.7.3
-
cpe:2.3:a:jupyter:notebook:5.7.4
-
cpe:2.3:a:jupyter:notebook:5.7.5
-
cpe:2.3:a:jupyter:notebook:5.7.6
-
cpe:2.3:a:jupyter:notebook:5.7.7
-
cpe:2.3:a:jupyter:notebook:5.7.8
-
cpe:2.3:a:jupyter:notebook:5.7.9
-
cpe:2.3:a:jupyter:notebook:6.4.0