CVE-2021-32862: falha de alta gravidade em jupyter nbconvert
nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 1.5%
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
jupyter · nbconvertCVEs relacionadas — jupyter nbconvert
No mesmo produto, das mais perigosas para as menos.
CVE-2026-114140HIGHnbconvert: File write via path traversal in cell output filenamesEPSS 0.5%CVE-2026-39378MEDIUMnbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image EmbeddingEPSS 0.3%CVE-2026-39377MEDIUMnbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment FilenamesEPSS 0.3%CVE-2025-53000HIGHnbconvert has an uncontrolled search path that leads to unauthorized code execution on WindowsEPSS 0.3%