CVE-2021-32862: fallo de gravedad alta en jupyter nbconvert
nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 1.5%
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
jupyter · nbconvertCVEs relacionadas — jupyter nbconvert
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-114140HIGHnbconvert: File write via path traversal in cell output filenamesEPSS 0.5%CVE-2026-39378MEDIUMnbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image EmbeddingEPSS 0.3%CVE-2026-39377MEDIUMnbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment FilenamesEPSS 0.3%CVE-2025-53000HIGHnbconvert has an uncontrolled search path that leads to unauthorized code execution on WindowsEPSS 0.3%