CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2018-19352
Medium (6.1) in jupyter notebook. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in notebook 5.7.2.
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jupyter:notebook
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3p4q-x8f3-p7vq | PyPI | notebook | <5.7.2 | 5.7.2 |
| PYSEC-2018-18 | PyPI | notebook | <5.7.2 | 5.7.2 |
References
- https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
- https://github.com/jupyter/notebook/commit/288b73e1edbf527740e273fcc69b889460871648
- https://pypi.org/project/notebook/#history
- https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
- https://github.com/jupyter/notebook/commit/288b73e1edbf527740e273fcc69b889460871648