https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T19:34:23.300681+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2018-19351 CVE-2018-19351 2026-10-01T19:34:23.355345+00:00

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

 https://vulnerability.circl.lu/vuln/ghsa-49qr-xh3w-h436 GHSA-49qr-xh3w-h436 — Jupyter Notebook XSS via untrusted notebooks 2026-10-01T19:34:23.355440+00:00

Affected: PyPI: notebook

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

 https://vulnerability.circl.lu/vuln/pysec-2018-17 PYSEC-2018-17 2026-10-01T19:34:23.355490+00:00

Affected: PyPI: notebook

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.