DescriptionIn Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs893436

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ipython (PTS)jessie2.3.0-2vulnerable
bullseye, sid7.13.0-1fixed
jupyter-notebook (PTS)stretch4.2.3-4vulnerable
bullseye, sid6.0.3-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[stretch] - jupyter-notebook <no-dsa> (Minor issue)
[jessie] - ipython <no-dsa> (Minor issue)
[wheezy] - ipython <ignored> (Too invasive to fix)
After the reupload of ipython to Debian as 4.1.2-1 via experimental
src:ipython does not provide anymore the Notebook
Fixed by:
Ipython in Wheezy lacks sanitization of untrusted HTML completely
which means in theory this CVE does not apply. However due to the absence of
sanitization it is recommended not to use Ipython's notebook with untrusted
content. This issue is no-dsa because it cannot be determined if Ipython
in Wheezy is still affected, a fix appears to be to intrusive though. We recommend to
upgrade to a newer version instead.

Search for package or bug name: Reporting problems