VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Sep 21, 2015· Updated May 6, 2026

CVE-2015-6938

CVE-2015-6938

Description

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
notebookPyPI
>= 4.0.0, < 4.0.54.0.5
ipythonPyPI
< 3.2.23.2.2

Affected products

11
  • Python (programming language)/Notebook
    cpe:2.3:a:ipython:notebook:*:*:*:*:*:*:*:*
    Range: <=3.2.1
  • Jupyter/Notebook5 versions
    cpe:2.3:a:jupyter:notebook:4.0.0:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:jupyter:notebook:4.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:jupyter:notebook:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:jupyter:notebook:4.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:jupyter:notebook:4.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:jupyter:notebook:4.0.4:*:*:*:*:*:*:*
  • Fedoraproject/Fedora3 versions
    cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
  • OpenSUSE/openSUSE2 versions
    cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
    • cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Patches

3
3ab41641cf6f

Fix XSS reported on Security list

https://github.com/ipython/ipythonMatthias BussonnierSep 1, 2015via ghsa
commit
1 file changed · +3 −1
  • IPython/html/notebookapp.py+3 −1 modified
    @@ -158,7 +158,9 @@ def init_settings(self, ipython_app, kernel_manager, contents_manager,
             _template_path = (_template_path,)
         template_path = [os.path.expanduser(path) for path in _template_path]
 
-        jenv_opt = jinja_env_options if jinja_env_options else {}
+        jenv_opt = {"autoescape": True}
+        jenv_opt.update(jinja_env_options if jinja_env_options else {})
+
         env = Environment(loader=FileSystemLoader(template_path), **jenv_opt)
         
         sys_info = get_sys_info()
dd9876381f0e

Fix XSS reported on Security list

https://github.com/jupyter/notebookMatthias BussonnierAug 21, 2015via ghsa
commit
1 file changed · +3 −1
  • notebook/notebookapp.py+3 −1 modified
    @@ -160,7 +160,9 @@ def init_settings(self, ipython_app, kernel_manager, contents_manager,
             _template_path = (_template_path,)
         template_path = [os.path.expanduser(path) for path in _template_path]
 
-        jenv_opt = jinja_env_options if jinja_env_options else {}
+        jenv_opt = {"autoescape": True}
+        jenv_opt.update(jinja_env_options if jinja_env_options else {})
+
         env = Environment(loader=FileSystemLoader(template_path), **jenv_opt)
         
         sys_info = get_sys_info()
35f32dd2da80

Fix XSS reported on Security list

https://github.com/jupyter/notebookMatthias BussonnierAug 21, 2015via ghsa
commit
1 file changed · +3 −1
  • notebook/notebookapp.py+3 −1 modified
    @@ -159,7 +159,9 @@ def init_settings(self, ipython_app, kernel_manager, contents_manager,
             _template_path = (_template_path,)
         template_path = [os.path.expanduser(path) for path in _template_path]
 
-        jenv_opt = jinja_env_options if jinja_env_options else {}
+        jenv_opt = {"autoescape": True}
+        jenv_opt.update(jinja_env_options if jinja_env_options else {})
+
         env = Environment(loader=FileSystemLoader(template_path), **jenv_opt)
         
         sys_info = get_sys_info()

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.