CVE-2021-32798: jupyter notebook Cross-site Scripting
Vulnerability summary
CVE-2021-32798 is a critical (CVSS 10.0) Cross-site Scripting vulnerability in jupyter notebook. EPSS estimates a 2.11% chance of exploitation in the next 30 days, higher than 81.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 09-08-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · PypiEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HDiffers
- NVDNIST9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
2.11%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.11% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNotebook
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- jupyter-notebook< 6.4.3-1
Jupyter1 product
- notebook≥ 6.0.0, < 6.4.1 | < 5.7.11 | ≥ 5.7.0, < 5.7.11 | 6.4.0
PyPI1 product
- notebook< 5.7.11 | ≥ 6.0.0, < 6.4.1 | < 79fc76e890a8ec42f73a3d009e44ef84c14ef0d5 | ≥ 5.7.0, < 5.7.11
Ubuntu1 product
- jupyter-notebookAll versions (No fix recorded)
4 vendors · 4 products
References
8 links- github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797X Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
- github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5X Refsource MISCWEBFIXREPORTExploitThird Party Advisory
- github.com/jupyter/notebookPACKAGE
