CVE-2021-32798

Advisory

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-hwvq-6gjx-j797
• https://nvd.nist.gov/vuln/detail/CVE-2021-32798
• https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797
• https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32798