Executive brief
Jupyter nbdime is a tool used to compare and merge Jupyter notebook files. The vulnerability allows attackers to inject malicious scripts into notebooks that execute in the browser when the notebook is viewed, potentially compromising user sessions or stealing data. This affects anyone using nbdime to view or diff notebooks that may contain attacker-controlled content.
Technical details
A stored cross-site scripting (XSS) vulnerability in nbdime results from improper sanitization of user-controlled input during notebook rendering. The vulnerability affects all major versions prior to their respective patches (Python 1.x before 1.1.1, 2.x before 2.1.1, 3.x before 3.1.1; npm 5.x before 5.0.2, 6.x before 6.1.2). An attacker can inject malicious JavaScript into notebook cells that persists in the file and executes when any user views the notebook through nbdime's web interface. No authentication bypass is required—the attack relies on user interaction (viewing the malicious notebook). The vulnerability has been patched across all affected versions.
Affected products
- Project Jupyter nbdime Python: <1.1.1, >=2.0.0 <2.1.1, >=3.0.0 <3.1.1; npm: <5.0.2, >=6.0.0 <6.1.2
- Project Jupyter nbdime-jupyterlab <1.0.1, >=2.0.0 <2.1.1
Timeline
- 2021-11-03: disclosed: Vulnerability publicly disclosed
- 2021-11-03: patched: Patches released: nbdime 1.1.1, 2.1.1, 3.1.1 (Python); 5.0.2, 6.1.2 (npm); nbdime-jupyterlab 1.0.1, 2.1.1