CVE-2019-9644

5.4 mediumEPSS 1.5%

An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2019-03-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jupyter:notebook

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-hhx8-cr55-qcxx	PyPI	jupyter-notebook	<5.7.6	5.7.6
GHSA-hhx8-cr55-qcxx	PyPI	notebook	<5.7.6	5.7.6
PYSEC-2019-159	PyPI	notebook	<5.7.6	5.7.6
PYSEC-2026-2531	PyPI	jupyter-notebook	<5.7.6	5.7.6

References

Check your stack JSON