What’s Vulnerable › Vulnerabilities

CVE-2018-19351

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-11-18 · updated 2026-06-17
• Weakness: CWE-79

Description

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

Affected products

• jupyter notebook: before 5.7.1 — fixed in 5.7.1

How to fix

Upgrade to a fixed version: jupyter notebook 5.7.1. Check the vendor advisory for mitigations.

References

• https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
• https://github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491
• https://groups.google.com/forum/#%21topic/jupyter/hWzu2BSsplY
• https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
• https://pypi.org/project/notebook/#history
• https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
• https://github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491
• https://groups.google.com/forum/#%21topic/jupyter/hWzu2BSsplY
• https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
• https://pypi.org/project/notebook/#history

Get alerted when CVE-2018-19351 or the next vulnerability affects your stack