PYSEC-2018-57

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/notebook/PYSEC-2018-57.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2018-57
Aliases
Published
2018-03-18T06:29:00Z
Modified
2023-11-01T05:19:19.086614Z
Summary
[none]
Details

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

References

Affected packages

PyPI / notebook

Package

Name
notebook
View open source insights on deps.dev
Purl
pkg:pypi/notebook

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.4.1

Affected versions

0.*

0.0.0

4.*

4.0.0
4.0.1
4.0.2
4.0.4
4.0.5
4.0.6
4.1.0
4.2.0b1
4.2.0
4.2.1
4.2.2
4.2.3
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1

5.*

5.0.0b1
5.0.0b2
5.0.0rc1
5.0.0rc2
5.0.0
5.1.0rc1
5.1.0rc2
5.1.0rc3
5.1.0
5.2.0rc1
5.2.0
5.2.1rc1
5.2.1
5.2.2
5.3.0rc1
5.3.0
5.3.1
5.4.0

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/notebook/PYSEC-2018-57.yaml"