CVE-2018-19352 Jupyter Notebook XSS via directory name
Attackers can execute arbitrary scripts in Jupyter Notebook via crafted directory names, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-19352?
CVE-2018-19352 is a medium-severity cross-site scripting vulnerability in n/a, published on 18 Nov 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
Weakness: CWE-79
Which versions are affected by CVE-2018-19352?
3 open source packages ship an affected version, including notebook. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
notebook PyPI | All versions | 5.7.2 |
notebook PyPI | All versions | 5.7.2 |
notebook PyPI | All versions | 5.7.2 |
Products include Jupyter Notebook.
How do I fix CVE-2018-19352?
Upgrade notebook to 5.7.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-19352 being exploited?
There is no known exploitation of CVE-2018-19352 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-32798 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook
- CVE-2018-8768 Jupyter Notebook file bypasses sanitization, executes JavaScript
- CVE-2022-24758 Insertion of Sensitive Information into Log File affects Jupyter Notebook
- CVE-2019-10856 Jupyter Notebook open redirect vulnerability
- CVE-2018-19351 Jupyter Notebook XSS via untrusted notebooks
Sources
Also known as DEBIAN-CVE-2018-19352, GHSA-3p4q-x8f3-p7vq, PYSEC-2018-18.