VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 18, 2018· Updated Aug 5, 2024

CVE-2018-19351

CVE-2018-19351

Description

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jupyter Notebook before 5.7.1 allows cross-site scripting (XSS) via untrusted notebooks because nbconvert endpoints lack a Content Security Policy.

Vulnerability

Jupyter Notebook versions prior to 5.7.1 contain a cross-site scripting (XSS) vulnerability in the nbconvert endpoints. The NbconvertFileHandler and NbconvertPostHandler in notebook/nbconvert/handlers.py do not set a Content Security Policy (CSP) header. As a result, responses from nbconvert are treated as having the same origin as the notebook server, allowing arbitrary JavaScript execution when a user opens a malicious notebook [1][4]. The vulnerability is triggered when a user converts or exports an untrusted notebook (e.g., via "Download as" or "Print Preview") [1].

Exploitation

An attacker can craft a notebook containing malicious JavaScript code. When a victim user opens that notebook and triggers an nbconvert operation (such as exporting to HTML or PDF), the malicious script executes in the context of the notebook server's origin. No special network position or authentication is required beyond the victim having access to the notebook server and opening the crafted notebook [1]. The attacker does not need write access to the server; the notebook can be shared via any means (e.g., email, upload).

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser with access to the notebook server's API. This can lead to data theft (e.g., reading notebook contents, accessing server resources), modification of notebooks, or further attacks against the server and other users [1]. The impact is limited to the same-origin context of the notebook server, but since the server API is accessible, the attacker can perform actions as the victim user.

Mitigation

The vulnerability is fixed in Jupyter Notebook version 5.7.1, released on 2018-11-18 [2]. Users should upgrade to at least version 5.7.1. Note that Notebook v5 is no longer maintained; users are strongly advised to upgrade to Classic Notebook v6 or Notebook v7 [2][3]. No workaround is available for unpatched versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. NVD - CVE-2018-19351
  2. notebook
  3. GitHub - jupyter/notebook: Jupyter Interactive Notebook
  4. advisory-database/vulns/notebook/PYSEC-2018-17.yaml at main · pypa/advisory-database

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
notebookPyPI
< 5.7.15.7.1

Affected products

1

Patches

1
107a89fce5f4

Apply CSP sandboxing for nbconvert responses

https://github.com/jupyter/notebookThomas KluyverOct 22, 2018via ghsa
commit
1 file changed · +14 −0
  • notebook/nbconvert/handlers.py+14 −0 modified
    @@ -78,6 +78,13 @@ class NbconvertFileHandler(IPythonHandler):
 
     SUPPORTED_METHODS = ('GET',)
 
+    @property
+    def content_security_policy(self):
+        # In case we're serving HTML/SVG, confine any Javascript to a unique
+        # origin so it can't interact with the notebook server.
+        return super(NbconvertFileHandler, self).content_security_policy + \
+               "; sandbox allow-scripts"
+
     @web.authenticated
     def get(self, format, path):
 
@@ -145,6 +152,13 @@ def get(self, format, path):
 class NbconvertPostHandler(IPythonHandler):
     SUPPORTED_METHODS = ('POST',)
 
+    @property
+    def content_security_policy(self):
+        # In case we're serving HTML/SVG, confine any Javascript to a unique
+        # origin so it can't interact with the notebook server.
+        return super(NbconvertPostHandler, self).content_security_policy + \
+               "; sandbox allow-scripts"
+
     @web.authenticated
     def post(self, format):
         exporter = get_exporter(format, config=self.config)

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.