CVE-2018-8768: High severity jupyter notebook vulnerability
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/notebookto a version that resolves this vulnerability.Fixed in 5.4.1 - Upgrade
Upgrade
Jupyter Notebookto a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Frequently Asked Questions
What is CVE-2018-8768?
CVE-2018-8768 is a vulnerability in Jupyter Notebook before version 5.4.1 that allows a maliciously forged notebook file to execute JavaScript in the notebook context.
How does CVE-2018-8768 work?
CVE-2018-8768 works by bypassing sanitization in Jupyter Notebook, allowing invalid HTML to be executed as JavaScript.
What is the severity of CVE-2018-8768?
The severity of CVE-2018-8768 is high with a severity value of 7.8.
What software versions are affected by CVE-2018-8768?
Jupyter Notebook versions up to and excluding 5.4.1 are affected by CVE-2018-8768.
How can I fix CVE-2018-8768?
To fix CVE-2018-8768, it is recommended to upgrade Jupyter Notebook to version 5.4.1 or newer.