Executive brief
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
Affected products
- PyPI notebook
Junglewise Threat Intelligence
CVE-2018-21030: PYSEC-2019-157 - Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS p
CVE-2018-21030 · Severity: low · CVSS 3.1 · Published 2019-10-31
Technologies: notebook (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2682 - Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
- PYSEC-2026-2536 - HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
- PYSEC-2026-2534 - JupyterLab vulnerable to potential authentication and CSRF tokens leak
- PYSEC-2026-2535 - JupyterLab vulnerable to SXSS in Markdown Preview
- PYSEC-2026-2531 - Improper Neutralization of Input During Web Page Generation in Jupyter Notebook