8.7

CVE-2021-41134: jupyter nbdime Cross-site Scripting

CVSS: 8.7v3.1HighModified
AliasesGHSA-p6rw-44q7-3fw4PYSEC-2021-428
Published 03-11-2021Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-41134 is a high (CVSS 8.7) Cross-site Scripting vulnerability in jupyter nbdime. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.4% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v3.1 (CVE.org)
EPSS score
0.70%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 03-11-2021
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint), nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function. From there, the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product.

CVSS metrics

7 scores · 4 sources · 3 versions

EPSS trend

Probability

0.70%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

0.00 pp

From 0.70% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.70%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Jupyter2 products
  • nbdime< 1.1.1 - nbdime (pip) | ≥ 2.0.0 , < 2.1.1 - nbdime (pip) (No fix recorded) | ≥ 3.0.0, < 3.1.1 - nbdime (pip) (No fix recorded) | < 5.0.2 - nbdime (npm) | ≥ 6.0.0, < 6.1.2 - nbdime (npm) (No fix recorded) | < 1.0.1 - nbdime-jupyterlab (npm) | ≥ 2.0.0, < 2.1.1 - nbdime-jupyterlab (npm) (No fix recorded) | ≥ 1.0.0, < 1.1.1 | ≥ 2.0.0, < 2.1.1 | ≥ 3.0.0, ≤ 3.1.1 | ≥ 5.0.0, < 5.0.2 | ≥ 6.0.0, < 6.1.2
  • nbdime-jupyterlab≥ 1.0.0, < 1.0.1 | ≥ 2.0.0, < 2.1.1
Npm2 products
  • nbdime< 5.0.2 | ≥ 6.0.0, < 6.1.2
  • nbdime-jupyterlab< 1.0.1 | ≥ 2.0.0, < 2.1.1
PyPI1 product
  • nbdime< 1.1.1 | ≥ 2.0.0, < 2.1.1 | ≥ 3.0.0, < 3.1.1 | < e44a5cc7677f24b45ebafc756db49058c2f750ea

3 vendors · 5 products

References

5 links