CVE-2018-8768

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2018-03-18

Last modified

2024-08-05

Affected products

• Notebook (Jupyter)

References

• http://openwall.com/lists/oss-security/2018/03/15/2
• https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html