CVE-2021-32798: Jupyter Notebook Untrusted Notebook Code Execution
Summary
CVE-2021-32798: The Jupyter notebook is a web-based notebook environment for interactive computing. Affects notebook across 2 version ranges.
>= 5.7.0, < 5.7.11
< 79fc76e890a8ec42f73a3d009e44ef84c14ef0d5
Fixed in 79fc76e890a8ec42f73a3d009e44ef84c14ef0d5. How to fix ↓
Also tracked for
- jupyter-notebook · Bitnami
- jupyter-base-notebook · Bitnami
- jupyter-notebook · Debian:11
The same CVE-2021-32798 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Notebook is a web-based notebook environment used for interactive computing. It allows users to create and share documents containing live code, equations, visualizations, and narrative text. The notebook files, known as ipynb documents, can be executed on the Jupyter server, enabling users to run code and view the output directly in their web browsers. Jupyter Notebook relies on Google Caja, a tool for sanitizing user inputs, to prevent malicious code execution. However, an outdated version of Google Caja is used, which introduces a vulnerability that allows untrusted notebooks to execute code on load.
Vulnerability Detail
The vulnerability in Jupyter Notebook arises from the use of a deprecated version of Google Caja for input sanitization. This deprecated version can be bypassed, leading to a cross-site scripting (XSS) attack when a user opens a malicious ipynb document. The XSS attack enables an attacker to execute arbitrary code on the victim's computer using Jupyter APIs. This can result in unauthorized access, data theft, or further compromise of the victim's system.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
79fc76e890a8ec42f73a3d009e44ef84c14ef0d5
This is the first release that contains the fix.
pip install --upgrade "notebook==79fc76e890a8ec42f73a3d009e44ef84c14ef0d5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Jupyter Notebook to the fixed version to mitigate the risk of exploitation.
Conclusion
The vulnerability in Jupyter Notebook allows untrusted notebooks to execute code on load, leading to a cross-site scripting (XSS) attack. To mitigate this risk, it is crucial to update Jupyter Notebook to version 5.7.11 or later. This will ensure that the necessary fix is applied, preventing the execution of arbitrary code by malicious ipynb documents. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
Jupyter Notebook is a web-based notebook environment used for interactive computing. It allows users to create and share documents containing live code, equations, visualizations, and narrative text.
This vulnerability allows untrusted notebooks to execute code on load, leading to a cross-site scripting (XSS) attack. An attacker can execute arbitrary code on the victim's computer using Jupyter APIs, potentially resulting in unauthorized access, data theft, or further compromise of the victim's system.
To fix this vulnerability, update Jupyter Notebook to version 5.7.11 or later. This version includes the necessary fix to prevent the XSS attack.
No, there is no known workaround for this vulnerability. It is crucial to update Jupyter Notebook to the fixed version to mitigate the risk of exploitation.
You can find more information about this vulnerability in the advisory database of the Python Package Index (PyPI). The specific advisory for this vulnerability can be accessed at: [advisory link].
References
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
