CVE-2018-8768: Jupyter Notebook file bypasses sanitization, executes JavaScript

July 12, 2018 (updated September 27, 2024)

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is ‘fixed’ by jQuery after sanitization, making it dangerous.

References

github.com/advisories/GHSA-6cwv-x26c-w2q4
github.com/jupyter/notebook
github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2018-57.yaml
lists.debian.org/debian-lts-announce/2020/11/msg00033.html
nvd.nist.gov/vuln/detail/CVE-2018-8768

Code Behaviors & Features

Detect and mitigate CVE-2018-8768 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →