Jupyter Notebook
18 CVEs affecting Jupyter Notebook. Latest disclosed: 2026-05-13. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32798 | Critical | 10.0 | 2021-08-09 | The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter N… |
CVE-2026-42557 | Critical | 9.6 | 2026-05-13 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HT… |
CVE-2018-8768 | High | 7.8 | 2018-03-18 | In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, inval… |
CVE-2024-43805 | High | 7.6 | 2024-08-28 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on u… |
CVE-2024-22421 | High | 7.6 | 2024-01-19 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who cli… |
CVE-2022-24758 | High | 7.5 | 2022-03-31 | The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive informatio… |
CVE-2024-22420 | Medium | 6.5 | 2024-01-19 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends… |
CVE-2019-10856 | Medium | 6.1 | 2019-04-04 | In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255. |
CVE-2019-10255 | Medium | 6.1 | 2019-03-28 | An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted… |
CVE-2018-19352 | Medium | 6.1 | 2018-11-18 | Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely. |
CVE-2018-19351 | Medium | 6.1 | 2018-11-18 | Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. I… |
CVE-2019-9644 | Medium | 5.4 | 2019-03-12 | An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are au… |
CVE-2018-21030 | Medium | 5.3 | 2019-10-31 | Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be place… |
CVE-2020-26215 | Medium | 4.4 | 2020-11-18 | Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a diffe… |
CVE-2022-29238 | Medium | 4.3 | 2022-06-14 | Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `Co… |
CVE-2026-40171 | | 2026-05-06 | In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab… | |
CVE-2015-7337 | | 2015-09-29 | The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted… | |
CVE-2015-6938 | | 2015-09-21 | Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0… |