CVE-2021-32862: debian debian_linux Cross-site Scripting
Vulnerability summary
CVE-2021-32862 is a high (CVSS 7.5) Cross-site Scripting vulnerability in debian debian_linux. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 18-08-2022PublishedVulnerability first disclosed.
- 02-09-2024Last modifiedVulnerability information updated.
Description
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
1.48%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
+0.09 pp
From 1.38% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNbconvert
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- nbconvert< 6.5.1-1 | < 5.4-2+deb10u1 | < 5.6.1-3+deb11u1
- debian_linuxEOL10.0
Chainguard1 product
- kubeflow-pipelines-visualization-server< 2.4.0-r0
Jupyter1 product
- nbconvert≤ 6.2 | ≤ 6.2.0
PyPI1 product
- nbconvert< 6.5.1 | < 6.3.0a0
Ubuntu1 product
- nbconvertAll versions (No fix recorded)
Wolfi1 product
- kubeflow-pipelines-visualization-server< 2.4.0-r0
6 vendors · 7 products
References
10 links- github.com/jupyter/nbconvert/security/advisories/GHSA-9jmq-rx5f-8jwqWEBAdvisoryREPORTEVIDENCEExploitThird Party Advisory
lists.debian.org/debian-lts-announce/2023/06/msg00003.htmlMailing ListWEBAdvisoryThird Party Advisory
- github.com/jupyter/nbconvertPACKAGE