p PatchFirst

CVE-2018-8768

CVE-2018-8768

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

CVSS 8.4 · High · EPSS 1.0% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • ipython Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.1.0-2

    Update to 5.1.0-2

  • ipython Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.1.0-2

    Update to 5.1.0-2

  • ipython Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.1.0-2

    Update to 5.1.0-2

  • jupyter-notebook Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.4.1-1

    Update to 5.4.1-1

  • jupyter-notebook Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.4.1-1

    Update to 5.4.1-1

  • jupyter-notebook Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.4.1-1

    Update to 5.4.1-1

  • notebook PyPI

    Versions
    • 0.0.0
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.0.4
    • 4.0.5
    • 4.0.6
    • 4.1.0
    • 4.2.0
    • 4.2.0b1
    • 4.2.1
    • 4.2.2
    • 4.2.3
    • 4.3.0
    • 4.3.1
    • 4.3.2
    • 4.4.0
    • 4.4.1
    • 5.0.0
    • 5.0.0b1
    • 5.0.0b2
    • 5.0.0rc1
    • 5.0.0rc2
    • 5.1.0
    • 5.1.0rc1
    • 5.1.0rc2
    • 5.1.0rc3
    • 5.2.0
    • 5.2.0rc1
    • 5.2.1
    • 5.2.1rc1
    • 5.2.2
    • 5.3.0
    • 5.3.0rc1
    • 5.3.1
    • 5.4.0
    Affected ranges
    • ECOSYSTEM: < 5.4.1

    Update to 5.4.1

  • ipython Ubuntu:Pro:16.04:LTS

    Versions
    • 2.3.0-2ubuntu1
    • 2.3.0-2ubuntu2
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: < 2.4.1-1ubuntu0.1~esm2

    Update to 2.4.1-1ubuntu0.1~esm2

Original sources

Check your server →