CVE-2015-6938: Cross-Site Scripting (XSS) Vulnerability in IPython Notebook and Jupyter Notebook
Summary
CVE-2015-6938: Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or H... Affects notebook across 3 version ranges.
>= 4.0.0, < 4.0.5
< 35f32dd2da804d108a3a3585b69ec3295b2677ed
< dd9876381f0ef09873d8c5f6f2063269172331e3
Fixed in 35f32dd2da804d108a3a3585b69ec3295b2677ed. How to fix ↓
Also tracked for
The same CVE-2015-6938 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPython Notebook is an interactive computational environment for creating and sharing documents containing live code, equations, visualizations, and explanatory text. Jupyter Notebook is the successor to IPython Notebook and provides similar functionality. These tools are widely used by data scientists, researchers, and developers for data analysis, machine learning, and collaborative coding. However, a vulnerability exists in the file browser component of IPython Notebook before version 3.2.2 and Jupyter Notebook 4.0.x before version 4.0.5, which allows remote attackers to inject arbitrary web script or HTML via a folder name.
Vulnerability Detail
The vulnerability in IPython Notebook and Jupyter Notebook is a cross-site scripting (XSS) vulnerability. It occurs when user-supplied input is not properly sanitized and is directly included in the HTML output. In this case, the folder name provided by the user is not properly sanitized, allowing an attacker to inject malicious script or HTML code. This can lead to various security risks, including session hijacking, phishing attacks, and unauthorized access to user data. It is important to note that this vulnerability was initially reported as a cross-site request forgery (CSRF) vulnerability, but further analysis suggests that it is an XSS vulnerability.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
35f32dd2da804d108a3a3585b69ec3295b2677ed
This is the first release that contains the fix.
pip install --upgrade "notebook==35f32dd2da804d108a3a3585b69ec3295b2677ed"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest versions is not immediately feasible, users can mitigate the risk of this vulnerability by avoiding the use of folder names that contain untrusted or user-supplied content. By carefully choosing folder names and ensuring they do not include any potentially malicious script or HTML code, users can reduce the likelihood of exploitation. Additionally, it is recommended to implement a web application firewall (WAF) that can detect and block XSS attacks.
Conclusion
The cross-site scripting (XSS) vulnerability in IPython Notebook and Jupyter Notebook allows remote attackers to inject arbitrary web script or HTML via a folder name. Upgrading to the latest versions of the affected software is the recommended solution to mitigate this vulnerability. Users should also exercise caution when choosing folder names and consider implementing additional security measures, such as a web application firewall (WAF), to further protect their systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
The vulnerability allows remote attackers to inject arbitrary web script or HTML, which can lead to various security risks such as session hijacking, phishing attacks, and unauthorized access to user data.
You can use Vulert's playground at Vulert Scanner to check if your IPython Notebook or Jupyter Notebook installation is affected by this vulnerability. Simply provide the necessary information about your environment, and Vulert will analyze it for potential vulnerabilities.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely. Attackers can inject malicious script or HTML code by manipulating the folder name parameter in requests sent to the affected IPython Notebook or Jupyter Notebook instances.
There is no evidence of active attacks exploiting this vulnerability at the time of this report. However, it is crucial to apply the necessary fixes to prevent any potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
