Lucene search

K
osvGoogleOSV:GHSA-6CWV-X26C-W2Q4
HistoryJul 12, 2018 - 12:00 p.m.

Jupyter Notebook file bypasses sanitization, executes JavaScript

2018-07-1212:00:00
Google
osv.dev
11

EPSS

0.001

Percentile

30.4%

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is ‘fixed’ by jQuery after sanitization, making it dangerous.