CVE-2022-24758: high-severity vulnerability in jupyter notebook
Insertion of Sensitive Information into Log File affects Jupyter Notebook
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.1%
The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
jupyter · notebookRelated CVEs — jupyter notebook
In the same product, most dangerous first.
CVE-2021-32798CRITICALFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebookEPSS 2.1%CVE-2020-26215MEDIUMOpen redirect in Jupyter NotebookEPSS 1.2%CVE-2022-29238MEDIUMForced Browsing in Jupyter NotebookEPSS 1.2%CVE-2026-42557HIGHjupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted contentEPSS 0.5%CVE-2026-40171HIGHJupyter Notebook and JupyterLab token theft via stored XSS in help command linkerEPSS 0.5%