Reflected cross-site scripting (XSS) In notebook
Description
Cross-site scripting in Jupyter Notebook Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 pypi | 5.5.0rc1 | ||
 debian 11 | 5.7.4-1 | ||
debian 13 | 5.7.4-1 | ||
debian 12 | 5.7.4-1 | ||
debian 14 | 5.7.4-1 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8.
References
1. 2. 3. 4.