CVE-2021-32798: Special Element Injection in notebook
Summary
CVE-2021-32798: Special Element Injection in notebook. Affects notebook across 2 version ranges.
< 5.7.11
>= 6.0.0, < 6.4.1
Fixed in 5.7.11 or 6.4.1, depending on the release line you run. How to fix ↓
Also tracked for
- jupyter-notebook · Bitnami
- jupyter-base-notebook · Bitnami
- jupyter-notebook · Debian:11
The same CVE-2021-32798 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The notebook package is an open-source tool used for creating and sharing documents that contain live code, equations, visualizations, and narrative text. It provides an interactive environment for data analysis, machine learning, and collaborative work. The vulnerability in the notebook package allows for special element injection, which can lead to remote code execution when an untrusted notebook is opened. This vulnerability has a CVSS score of 10.0, indicating its critical severity.
Vulnerability Detail
The special element injection vulnerability in the notebook package allows an untrusted notebook to execute code on load. Although it requires user action to open a notebook, it can result in remote code execution. An attacker can exploit this vulnerability by crafting a notebook with malicious content in a cell. When the notebook is opened, the injected code will be executed, potentially leading to unauthorized access, data leakage, or other malicious activities. This vulnerability is classified under CWE-79, which is the Common Weakness Enumeration category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.7.115.7.11pip install --upgrade "notebook==5.7.11" -
>= 6.0.0, < 6.4.16.4.1pip install --upgrade "notebook==6.4.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that they only open trusted notebooks from reliable sources.
Conclusion
The special element injection vulnerability in the notebook package poses a critical risk as it allows for remote code execution. It is crucial to update the package to the patched versions to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for notebook →
FAQ
The vulnerability allows for remote code execution when an untrusted notebook is opened. However, it requires user action to open the notebook.
To fix this vulnerability, update the notebook package to version 5.7.11 or higher (for versions prior to 6.0.0) or version 6.4.1 or higher (for versions 6.0.0 and above).
Special element injection refers to the ability to inject malicious code or elements into a web page or application, potentially leading to security vulnerabilities or unauthorized actions.
Yes, this vulnerability has a CVSS score of 10.0, indicating its critical severity.
You can refer to the OWASP page on Injection Prevention Cheat Sheet for more information on preventing injection vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
