CVE-2018-8768: Jupyter Notebook HTML Sanitization Bypass
Summary
CVE-2018-8768: In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Affects notebook versions < 5.4.1. Fixed in 5.4.1. How to fix ↓
Also tracked for
- ipython · Debian:11
The same CVE-2018-8768 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Notebook is an open-source web application that allows users to create and share documents containing live code, equations, visualizations, and narrative text. It is widely used for data analysis, scientific research, and machine learning. The notebook files are stored in JSON format and can contain various types of content, including HTML code. Jupyter Notebook relies on sanitization to prevent the execution of malicious JavaScript code within the notebook context.
Vulnerability Detail
In versions of Jupyter Notebook prior to 5.4.1, a vulnerability exists that allows a maliciously crafted notebook file to bypass the HTML sanitization process and execute JavaScript code within the notebook context. The issue arises due to the incorrect handling of invalid HTML by the jQuery library used for sanitization. When invalid HTML is encountered, jQuery attempts to fix it, inadvertently introducing a security risk. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.4.1
This is the first release that contains the fix.
pip install --upgrade "notebook==5.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can apply a workaround by manually sanitizing the HTML code within the notebook files. This can be done by carefully reviewing and validating any HTML content present in the notebook and ensuring that it does not contain any malicious JavaScript code. Additionally, users should exercise caution when opening notebook files from untrusted sources.
Conclusion
The vulnerability in Jupyter Notebook prior to version 5.4.1 allows for the execution of malicious JavaScript code within the notebook context. To mitigate this risk, it is crucial to upgrade to the latest version or manually sanitize the HTML code within the notebook files. Users should exercise caution when handling notebook files from untrusted sources. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
Jupyter Notebook is an open-source web application used for creating and sharing documents containing live code, equations, visualizations, and narrative text. It is widely used in data analysis, scientific research, and machine learning.
This vulnerability allows an attacker to execute arbitrary JavaScript code within the Jupyter Notebook context. Depending on the privileges of the user running the notebook, this can lead to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade Jupyter Notebook to version 5.4.1 or later. Alternatively, users can manually sanitize the HTML code within the notebook files to mitigate the risk.
Yes, users can apply a workaround by carefully reviewing and validating any HTML content within the notebook files to ensure it does not contain malicious JavaScript code. Additionally, caution should be exercised when opening notebook files from untrusted sources.
For more information about this vulnerability, you can refer to the official advisory provided by the Python Package Authority (PyPA) advisory database. The link to the advisory is available in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
