CVE-2021-32862 nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths

High 7.5 Published 18 Aug 2022 Updated 2 Sep 2024

Attackers can inject arbitrary HTML into Jupyter notebooks converted to HTML, leading to cross-site scripting when served by web servers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-32862?

CVE-2021-32862 is a high-severity cross-site scripting vulnerability in Debian Debian Linux, published on 18 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Weakness: CWE-79

Which versions are affected by CVE-2021-32862?

3 open source packages ship an affected version, including nbconvert. It affects 2 products.

Package	Affected	Fixed in
`nbconvert` PyPI	All versions	`6.3.0a0`
`nbconvert` PyPI	All versions	`6.5.1`
`nbconvert` PyPI	All versions	`6.5.1`

Products include Debian Debian Linux, Jupyter Nbconvert.

How do I fix CVE-2021-32862?

Upgrade nbconvert to a fixed version for your release line: 6.3.0a0 or 6.5.1.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-32862 being exploited?

There is no known exploitation of CVE-2021-32862 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-32862, DLA-3442-1, DLA-3863-1, GHSA-9jmq-rx5f-8jwq, GHSA-h274-fcvj-h2wm, PYSEC-2022-249 and 1 more.