p PatchFirst

CVE-2021-32862

CVE-2021-32862 · nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

CVSS 7.5 · High · EPSS 1.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • nbconvert

    Versions
    • <= 6.2: Affected

    No fix published

  • nbconvert Debian:12

    Affected ranges
    • ECOSYSTEM: < 6.5.1-1

    Update to 6.5.1-1

  • nbconvert Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.5.1-1

    Update to 6.5.1-1

  • nbconvert Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.5.1-1

    Update to 6.5.1-1

  • nbconvert PyPI

    Versions
    • 0.0.0
    • 4.0.0
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 5.0.0
    • 5.0.0b1
    • 5.1.0
    • 5.1.1
    • 5.2.1
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 5.4.1
    • 5.4.1.dev0
    • 5.5.0
    • 5.6.0
    • 5.6.1
    • 6.0.0
    • 6.0.0a0
    • 6.0.0a1
    • 6.0.0a2
    • 6.0.0a3
    • 6.0.0a4
    • 6.0.0a5
    • 6.0.0a6
    • 6.0.0b7
    • 6.0.0rc0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    • 6.0.7
    • 6.1.0
    • 6.1.0rc0
    • 6.1.1b0
    • 6.2.0
    • 6.2.0rc0
    • 6.2.0rc1
    • 6.2.0rc2
    • 6.3.0
    • 6.3.0b0
    • 6.4.0
    • 6.4.1
    • 6.4.2
    • 6.4.3
    • 6.4.4
    • 6.4.5
    • 6.5.0
    Affected ranges
    • ECOSYSTEM: < 6.5.1

    Update to 6.5.1

  • nbconvert PyPI

    Versions
    • 0.0.0
    • 4.0.0
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 5.0.0
    • 5.0.0b1
    • 5.1.0
    • 5.1.1
    • 5.2.1
    • 5.3.0
    • 5.3.1
    • 5.4.0
    • 5.4.1
    • 5.4.1.dev0
    • 5.5.0
    • 5.6.0
    • 5.6.1
    • 6.0.0
    • 6.0.0a0
    • 6.0.0a1
    • 6.0.0a2
    • 6.0.0a3
    • 6.0.0a4
    • 6.0.0a5
    • 6.0.0a6
    • 6.0.0b7
    • 6.0.0rc0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    • 6.0.7
    • 6.1.0
    • 6.1.0rc0
    • 6.1.1b0
    • 6.2.0
    • 6.2.0rc0
    • 6.2.0rc1
    • 6.2.0rc2
    Affected ranges
    • ECOSYSTEM: < 6.3.0a0

    Update to 6.3.0a0

  • nbconvert Ubuntu:18.04:LTS

    Versions
    • 4.2.0-4
    • 5.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:20.04:LTS

    Versions
    • 5.4-2ubuntu2
    • 5.6.0-1
    • 5.6.0-2
    • 5.6.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:22.04:LTS

    Versions
    • 5.6.1-3
    • 6.1.0-1
    • 6.3.0-1
    • 6.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →