Safety vulnerability ID: 40384
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Notebook 5.7.6 includes a fix for vulnerability (CVE-2019-9644).
Latest version: 7.3.2
Jupyter Notebook - A web-based notebook environment for interactive computing
vulnerability (CVE-2019--9644), where files at a known URL could be
included in a page from an unauthorized website if the user is logged
into a Jupyter server. The fix involves setting the
`X-Content-Type-Options: nosniff` header, and applying CSRF checks
previously on all non-GET API requests to GET requests to API endpoints
and the /files/ endpoint.
The attacking page is able to access some contents of files when using
Internet Explorer through script errors, but this has not been
demonstrated with other browsers.
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application