CVE-2019-10856: Open Redirect Vulnerability in Jupyter Notebook
Summary
CVE-2019-10856: In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255. Affects notebook versions < 5.7.8. Fixed in 5.7.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Notebook is an open-source web application that allows users to create and share documents containing live code, equations, visualizations, and narrative text. It is widely used for data cleaning and transformation, numerical simulation, statistical modeling, data visualization, machine learning, and more. Jupyter Notebook is written in Python and provides an interactive computing environment that supports various programming languages.
Vulnerability Detail
The vulnerability identified as CVE-2019-10856 is an open redirect vulnerability in Jupyter Notebook versions prior to 5.7.8. This vulnerability occurs when an empty netloc is present, which can lead to unauthorized redirection of users to malicious websites. The issue stems from an incomplete fix for CVE-2019-10255. If exploited, an attacker could trick users into visiting a malicious site, potentially leading to phishing attacks, malware downloads, or other malicious activities.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.7.8
This is the first release that contains the fix.
pip install --upgrade "notebook==5.7.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The open redirect vulnerability (CVE-2019-10856) in Jupyter Notebook versions prior to 5.7.8 can potentially expose users to malicious websites and activities. It is crucial to upgrade to the fixed version to mitigate the risk. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
An open redirect vulnerability occurs when a web application allows unauthorized redirection to external URLs. Attackers can exploit this vulnerability to trick users into visiting malicious websites.
If exploited, this vulnerability can lead to phishing attacks, malware downloads, or other malicious activities. Users may unknowingly visit malicious websites, thinking they are legitimate.
Versions of Jupyter Notebook prior to 5.7.8 are affected by this vulnerability.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to the fixed version.
You can find more information about this vulnerability in the advisory database of the Python Packaging Authority (PyPA). The source link is provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
