CVE-2021-32798
Critical
Description
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
SeverityCritical
CVSS10.0
Exploit probability—
ProductJupyter Notebook
PublishedAug 9, 2021
First seenAug 9, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- jupyter notebook5.7.11 or later
- notebook5.7.11, 6.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyter notebook | 5.7.0 ≤ v < 5.7.11, 6.4.0 | 5.7.11 |
| notebookPyPI | v < 5.7.11, 6.0.0 ≤ v < 6.4.1, 5.7.0 ≤ v < 5.7.11 | 5.7.11, 6.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.