What’s Vulnerable › Vulnerabilities

CVE-2019-9644

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-12 · updated 2026-06-17
• Weakness: CWE-79

Description

An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.

Affected products

• jupyter notebook: before 5.7.6 — fixed in 5.7.6

How to fix

Upgrade to a fixed version: jupyter notebook 5.7.6. Check the vendor advisory for mitigations.

References

• https://github.com/jupyter/notebook/compare/f3f00df...05aa4b2
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO/
• https://github.com/jupyter/notebook/compare/f3f00df...05aa4b2
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO/

Get alerted when CVE-2019-9644 or the next vulnerability affects your stack