https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 04:43:43 +0000 https://vulnerability.circl.lu/vuln/cve-2025-23205 <p><strong>Affected:</strong> jupyter nbgrader</p> <p>nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: &#39;self&#39; grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice&#39;s page is on the same Origin as the formgrader iframe, Javasript on Alice&#39;s page has _full access_ to the contents of the page served by formgrader using Bob&#39;s credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).</p> <p><strong>Affected:</strong> jupyter nbgrader</p> <p>nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: &#39;self&#39; grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice&#39;s page is on the same Origin as the formgrader iframe, Javasript on Alice&#39;s page has _full access_ to the contents of the page served by formgrader using Bob&#39;s credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).</p> https://vulnerability.circl.lu/vuln/cve-2025-23205 https://vulnerability.circl.lu/vuln/pysec-2026-1692 <p><strong>Affected:</strong> PyPI: nbgrader</p> <p>### Impact</p> <p>Enabling frame-ancestors: &#39;self&#39; grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`.</p> <p>#1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice&#39;s page is on the same Origin as the formgrader iframe, Javasript on Alice&#39;s page has _full access_ to the contents of the page served by formgrader using Bob&#39;s credentials.</p> <p>### Workarounds</p> <p>- Disable `frame-ancestors: self`, or - enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).</p> <p>### References</p> <p>JupyterHub documentation on why and when `frame-ancestors: self` is insecure, and why it was disabled by default: https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#:~:text=frame-ancestors</p> <p><strong>Affected:</strong> PyPI: nbgrader</p> <p>### Impact</p> <p>Enabling frame-ancestors: &#39;self&#39; grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`.</p> <p>#1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice&#39;s page is on the same Origin as the formgrader iframe, Javasript on Alice&#39;s page has _full access_ to the contents of the page served by formgrader using Bob&#39;s credentials.</p> <p>### Workarounds</p> <p>- Disable `frame-ancestors: self`, or - enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).</p> <p>### References</p> <p>JupyterHub documentation on why and when `frame-ancestors: self` is insecure, and why it was disabled by default: https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#:~:text=frame-ancestors</p> https://vulnerability.circl.lu/vuln/pysec-2026-1692