Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-32798

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-32798
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 08:55 UTC · Revision 1

Source evidence

CVE-2021-32798

core-osv · Original source

Published 9 Aug 2021, 21:15 UTC

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

osv:CVE-2021-32798
Complete source record
{
  "id": "d2e127a7662030ae71daaeccf5b347b0ee8c7ab1f1e291123c08d6ec24f02772",
  "url": "https://osv.dev/vulnerability/CVE-2021-32798",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-32798",
    "summary": "The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.",
    "evidence": "osv:CVE-2021-32798",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2021-32798",
      "aliases": [
        "BIT-jupyter-base-notebook-2021-32798",
        "BIT-jupyter-notebook-2021-32798",
        "CVE-2021-32798",
        "GHSA-hwvq-6gjx-j797",
        "PYSEC-2021-118"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/jupyter/notebook",
              "type": "GIT",
              "events": [
                {
                  "introduced": "775cb20de3dc273f1fc31cd55d895e16dfe98bdf"
                },
                {
                  "fixed": "48018b2feaf02dfa0d9d82f86d294da6f42bf92b"
                },
                {
                  "introduced": "0c35002e452dcb6ca9550b2f1280235d1f04eb27"
                },
                {
                  "last_affected": "0c35002e452dcb6ca9550b2f1280235d1f04eb27"
                },
                {
                  "fixed": "79fc76e890a8ec42f73a3d009e44ef84c14ef0d5"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "5.7.0"
                      },
                      {
                        "fixed": "5.7.11"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:jupyter:notebook:6.4.0:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "6.4.0"
                      },
                      {
                        "last_affected": "6.4.0"
                      }
                    ],
                    "source": "CPE_STRING"
                  },
                  {
                    "range": [
                      {
                        "fixed": "79fc76e890a8ec42f73a3d009e44ef84c14ef0d5"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "6.4.0",
            "5.7.10",
            "v6.4.0",
            "5.7.8",
            "5.7.7",
            "5.7.6",
            "5.7.5",
            "5.7.4",
            "5.7.3",
            "5.7.2",
            "5.7.1",
            "5.7.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32798.json"
          }
        },
        {
          "ranges": [
            {
              "repo": "https://github.com/jupyterlab/jupyterlab",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8ce37a58199674b1a7a44e2f5cb059465fcef411"
                },
                {
                  "last_affected": "8ce37a58199674b1a7a44e2f5cb059465fcef411"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:jupyter:notebook:6.4.0:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "6.4.0"
                      },
                      {
                        "last_affected": "6.4.0"
                      }
                    ],
                    "source": "CPE_STRING"
                  }
                ]
              }
            }
          ],
          "versions": [
            "6.4.0",
            "v4.4.0",
            "@jupyterlab/workspaces@4.4.0",
            "@jupyterlab/workspaces-extension@4.4.0",
            "@jupyterlab/vega5-extension@4.4.0",
            "@jupyterlab/ui-components@4.4.0",
            "@jupyterlab/ui-components-extension@4.4.0",
            "@jupyterlab/translation@4.4.0",
            "@jupyterlab/translation-extension@4.4.0",
            "@jupyterlab/tooltip@4.4.0",
            "@jupyterlab/tooltip-extension@4.4.0",
            "@jupyterlab/toc@6.4.0",
            "@jupyterlab/toc-extension@6.4.0",
            "@jupyterlab/theme-light-extension@4.4.0",
            "@jupyterlab/theme-dark-high-contrast-extension@4.4.0",
            "@jupyterlab/theme-dark-extension@4.4.0",
            "@jupyterlab/testutils@4.4.0",
            "@jupyterlab/testing@4.4.0",
            "@jupyterlab/terminal@4.4.0",
            "@jupyterlab/terminal-extension@4.4.0",
            "@jupyterlab/template@4.4.0",
            "@jupyterlab/statusbar@4.4.0",
            "@jupyterlab/statusbar-extension@4.4.0",
            "@jupyterlab/statedb@4.4.0",
            "@jupyterlab/shortcuts-extension@5.2.0",
            "@jupyterlab/settingregistry@4.4.0",
            "@jupyterlab/settingeditor@4.4.0",
            "@jupyterlab/settingeditor-extension@4.4.0",
            "@jupyterlab/services@7.4.0",
            "@jupyterlab/services-extension@4.4.0",
            "@jupyterlab/running@4.4.0",
            "@jupyterlab/running-extension@4.4.0",
            "@jupyterlab/rendermime@4.4.0",
            "@jupyterlab/rendermime-interfaces@3.12.0",
            "@jupyterlab/rendermime-extension@4.4.0",
            "@jupyterlab/property-inspector@4.4.0",
            "@jupyterlab/pluginmanager@4.4.0",
            "@jupyterlab/pluginmanager-extension@4.4.0",
            "@jupyterlab/pdf-extension@4.4.0",
            "@jupyterlab/outputarea@4.4.0",
            "@jupyterlab/observables@5.4.0",
            "@jupyterlab/notebook@4.4.0",
            "@jupyterlab/notebook-extension@4.4.0",
            "@jupyterlab/nbformat@4.4.0",
            "@jupyterlab/nbconvert-css@4.4.0",
            "@jupyterlab/metapackage@4.4.0",
            "@jupyterlab/metadataform@4.4.0",
            "@jupyterlab/metadataform-extension@4.4.0",
            "@jupyterlab/mermaid@4.4.0",
            "@jupyterlab/mermaid-extension@4.4.0",
            "@jupyterlab/mathjax-extension@4.4.0",
            "@jupyterlab/markedparser-extension@4.4.0",
            "@jupyterlab/markdownviewer@4.4.0",
            "@jupyterlab/markdownviewer-extension@4.4.0",
            "@jupyterlab/mainmenu@4.4.0",
            "@jupyterlab/mainmenu-extension@4.4.0",
            "@jupyterlab/lsp@4.4.0",
            "@jupyterlab/lsp-extension@4.4.0",
            "@jupyterlab/logconsole@4.4.0",
            "@jupyterlab/logconsole-extension@4.4.0",
            "@jupyterlab/launcher@4.4.0",
            "@jupyterlab/launcher-extension@4.4.0",
            "@jupyterlab/json-extension@4.4.0",
            "@jupyterlab/javascript-extension@4.4.0",
            "@jupyterlab/inspector@4.4.0",
            "@jupyterlab/inspector-extension@4.4.0",
            "@jupyterlab/imageviewer@4.4.0",
            "@jupyterlab/imageviewer-extension@4.4.0",
            "@jupyterlab/hub-extension@4.4.0",
            "@jupyterlab/htmlviewer@4.4.0",
            "@jupyterlab/htmlviewer-extension@4.4.0",
            "@jupyterlab/help-extension@4.4.0",
            "@jupyterlab/galata@5.4.0",
            "@jupyterlab/fileeditor@4.4.0",
            "@jupyterlab/fileeditor-extension@4.4.0",
            "@jupyterlab/filebrowser@4.4.0",
            "@jupyterlab/filebrowser-extension@4.4.0",
            "@jupyterlab/extensionmanager@4.4.0",
            "@jupyterlab/extensionmanager-extension@4.4.0",
            "@jupyterlab/documentsearch@4.4.0",
            "@jupyterlab/documentsearch-extension@4.4.0",
            "@jupyterlab/docregistry@4.4.0",
            "@jupyterlab/docmanager@4.4.0",
            "@jupyterlab/docmanager-extension@4.4.0",
            "@jupyterlab/debugger@4.4.0",
            "@jupyterlab/debugger-extension@4.4.0",
            "@jupyterlab/csvviewer@4.4.0",
            "@jupyterlab/csvviewer-extension@4.4.0",
            "@jupyterlab/coreutils@6.4.0",
            "@jupyterlab/console@4.4.0",
            "@jupyterlab/console-extension@4.4.0",
            "@jupyterlab/completer@4.4.0",
            "@jupyterlab/completer-extension@4.4.0",
            "@jupyterlab/codemirror@4.4.0",
            "@jupyterlab/codemirror-extension@4.4.0",
            "@jupyterlab/codeeditor@4.4.0",
            "@jupyterlab/celltags-extension@4.4.0",
            "@jupyterlab/cells@4.4.0",
            "@jupyterlab/cell-toolbar@4.4.0",
            "@jupyterlab/cell-toolbar-extension@4.4.0",
            "@jupyterlab/buildutils@4.4.0",
            "@jupyterlab/builder@4.4.0",
            "@jupyterlab/attachments@4.4.0",
            "@jupyterlab/apputils@4.5.0",
            "@jupyterlab/apputils-extension@4.4.0",
            "@jupyterlab/application@4.4.0",
            "@jupyterlab/application-extension@4.4.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32798.json"
          }
        }
      ],
      "modified": "2026-10-24T10:50:41.675753631Z",
      "provider": "osv",
      "references": [
        "https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797",
        "https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5"
      ],
      "provider_metadata": {
        "unresolved_ranges": [
          {
            "cpes": [
              "cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "jupyter:notebook",
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "5.7.0"
                  },
                  {
                    "fixed": "5.7.11"
                  }
                ],
                "source": "CPE_RANGE"
              }
            ]
          }
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2021-32798",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 442482,
  "published_at": "2021-08-09T21:15:08.233+00:00"
}