CVE-2018-19351: Jupyter Notebook XSS Vulnerability
Summary
CVE-2018-19351: Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. Affects notebook across 2 version ranges.
< 5.7.1
< 107a89fce5f413fb5728c1c5d2c7788e1fb17491
Fixed in 107a89fce5f413fb5728c1c5d2c7788e1fb17491. How to fix ↓
Also tracked for
- jupyter-notebook · Debian:11
The same CVE-2018-19351 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Notebook is an open-source web application that allows users to create and share documents containing live code, equations, visualizations, and narrative text. It is widely used for data cleaning and transformation, numerical simulation, statistical modeling, data visualization, machine learning, and more. Jupyter Notebook provides an interactive computing environment that supports various programming languages, including Python, R, and Julia. However, an XSS vulnerability has been discovered in Jupyter Notebook versions prior to 5.7.1.
Vulnerability Detail
The XSS vulnerability in Jupyter Notebook arises from the fact that nbconvert responses are considered to have the same origin as the notebook server. This allows untrusted notebooks to execute JavaScript with access to the server API. The specific files NbconvertFileHandler and NbconvertPostHandler in notebook/nbconvert/handlers.py do not set a Content Security Policy to prevent this. An attacker could exploit this vulnerability by crafting a malicious notebook that includes JavaScript code, which would be executed when the notebook is opened by a user. This could lead to various consequences, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or spreading malware.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
107a89fce5f413fb5728c1c5d2c7788e1fb17491
This is the first release that contains the fix.
pip install --upgrade "notebook==107a89fce5f413fb5728c1c5d2c7788e1fb17491"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can apply a workaround by manually setting a Content Security Policy (CSP) in the Jupyter Notebook configuration file. The CSP should restrict the execution of JavaScript code from untrusted sources. Here is an example of how to add a CSP directive to the configuration file:
- Open the Jupyter Notebook configuration file (jupyter_notebook_config.py).
- Add the following line to the file:
c.NotebookApp.tornado_settings = {
'headers': {
'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
}
}
- Save the file and restart the Jupyter Notebook server.
Note: This workaround may have limitations and it is still recommended to upgrade to the latest version for a comprehensive fix.
Conclusion
The XSS vulnerability in Jupyter Notebook versions prior to 5.7.1 poses a significant security risk, allowing attackers to execute malicious JavaScript code with access to the server API. To mitigate this vulnerability, users should upgrade to the latest version of Jupyter Notebook and consider applying a Content Security Policy (CSP) as a temporary workaround. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
Jupyter Notebook is an open-source web application that allows users to create and share documents containing live code, equations, visualizations, and narrative text. It is widely used for data analysis, machine learning, and scientific computing.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, perform unauthorized actions, or spread malware.
The XSS vulnerability in Jupyter Notebook occurs because nbconvert responses are considered to have the same origin as the notebook server. This allows untrusted notebooks to execute JavaScript code with access to the server API, leading to potential security risks.
The XSS vulnerability in Jupyter Notebook could allow an attacker to steal sensitive information, perform unauthorized actions on behalf of the user, or spread malware. This can have serious implications for data security and user privacy.
To protect yourself from this vulnerability, it is recommended to upgrade Jupyter Notebook to version 5.7.1 or later. Additionally, you can apply a workaround by manually setting a Content Security Policy (CSP) in the Jupyter Notebook configuration file.
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
