CVE-2021-32798: falha crítica em jupyter notebook
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 2.1%
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
jupyter · notebookCVEs relacionadas — jupyter notebook
No mesmo produto, das mais perigosas para as menos.
CVE-2020-26215MEDIUMOpen redirect in Jupyter NotebookEPSS 1.2%CVE-2022-29238MEDIUMForced Browsing in Jupyter NotebookEPSS 1.2%CVE-2022-24758HIGHInsertion of Sensitive Information into Log File affects Jupyter NotebookEPSS 1.1%CVE-2026-42557HIGHjupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted contentEPSS 0.5%CVE-2026-40171HIGHJupyter Notebook and JupyterLab token theft via stored XSS in help command linkerEPSS 0.5%