CVE-2018-19351

    Dashboard / Vulnerabilities / CVE-2018-19351

    CVE-2018-19351

    Published: 18 Nov 2018Last Modified: 7 Aug 2026

    Summary:

    Details: Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

    References: https://groups.google.com/forum/#%21topic/jupyter/hWzu2BSsplY, https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html, https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst, https://pypi.org/project/notebook/#history, https://github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -154fa08c48c4b549484347c9c5e1f7c85cf4e02d

    Affected versions

    5.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High