Vulnerabilities for notebook

First version without a known vulnerability: 7.0.0a1

Details

• GHSA-mqcg-5x36-vfcg2026-05-06

  JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

  Fixed in: 4.5.7, 7.5.6

• GHSA-rch3-82jr-f9w92026-04-30

  Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

  Fixed in: 7.5.6, 4.5.7

• GHSA-9q39-rmj3-p4r22024-08-29

  HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

  Fixed in: 3.6.8, 7.2.2, 4.2.5

• GHSA-44cc-43rp-59472024-01-19

  JupyterLab vulnerable to potential authentication and CSRF tokens leak

  Fixed in: 4.0.11, 3.6.7, 7.0.7

• GHSA-4m77-cmpx-vjc42024-01-19

  JupyterLab vulnerable to SXSS in Markdown Preview

  Fixed in: 4.0.11, 7.0.7

• GHSA-v7vq-3x77-87vg2022-06-16

  Token bruteforcing.

  Fixed in: 6.4.12

• GHSA-92mr-v722-f48m2022-05-17

  Improper Input Validation in Jupyter Notebook

  Fixed in: 4.0.5, 3.2.2, 9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5

• GHSA-4vwq-x64q-j4cj2022-05-14

  Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

  Fixed in: 4.0.5, 3.2.2, 35f32dd2da804d108a3a3585b69ec3295b2677ed, dd9876381f0ef09873d8c5f6f2063269172331e3

• GHSA-hhx8-cr55-qcxx2022-05-14

  Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

  Fixed in: 5.7.6

• GHSA-m87f-39q9-6f552022-04-05

  Sensitive Auth & Cookie data stored in Jupyter server logs

  Fixed in: 6.4.10

• GHSA-hwvq-6gjx-j7972021-08-23

  Special Element Injection in notebook

  Fixed in: 5.7.11, 6.4.1, 79fc76e890a8ec42f73a3d009e44ef84c14ef0d5

• GHSA-4952-p58q-6crx2021-08-23

  JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

  Fixed in: 1.2.21, 2.2.10, 2.3.2, 3.0.17, 3.1.4, 5.7.11, 6.4.1

• GHSA-c7vm-f5p4-8fqh2020-11-18

  Open redirect in Jupyter Notebook

  Fixed in: 6.1.5, 3cec4bbe21756de9f0c4bccf18cf61d840314d74

• GHSA-jqwc-jm56-wcwj2019-11-08

  Cross-site scripting in Jupyter Notebook

  Fixed in: 5.5.0rc1, 5.5.0

• GHSA-rcx2-m7jp-p9wj2019-04-09

  Jupyter Notebook open redirect vulnerability

  Fixed in: 5.7.8

• GHSA-rv62-4pmj-xw6h2019-04-02

  Open Redirect vulnerability in jupyterhub and notebook

  Fixed in: 5.7.8, 0.9.6

• GHSA-3p4q-x8f3-p7vq2018-11-21

  Jupyter Notebook XSS via directory name

  Fixed in: 5.7.2, 288b73e1edbf527740e273fcc69b889460871648

• GHSA-49qr-xh3w-h4362018-11-21

  Jupyter Notebook XSS via untrusted notebooks

  Fixed in: 5.7.1, 107a89fce5f413fb5728c1c5d2c7788e1fb17491

• GHSA-6cwv-x26c-w2q42018-07-12

  Jupyter Notebook file bypasses sanitization, executes JavaScript

  Fixed in: 5.4.1