{"schema_version":"1.8.0","id":"CVE-2021-32798","published":"2021-08-09T21:15:08.233Z","modified":"2026-08-07T17:02:07.227967Z","aliases":["BIT-jupyter-base-notebook-2021-32798","BIT-jupyter-notebook-2021-32798","GHSA-hwvq-6gjx-j797","PYSEC-2021-118"],"related":["openSUSE-SU-2024:0231-1"],"details":"The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jupyter/notebook","events":[{"introduced":"775cb20de3dc273f1fc31cd55d895e16dfe98bdf"},{"fixed":"48018b2feaf02dfa0d9d82f86d294da6f42bf92b"},{"introduced":"0c35002e452dcb6ca9550b2f1280235d1f04eb27"},{"last_affected":"0c35002e452dcb6ca9550b2f1280235d1f04eb27"},{"fixed":"79fc76e890a8ec42f73a3d009e44ef84c14ef0d5"}],"database_specific":{"cpe":["cpe:2.3:a:jupyter:notebook:*:*:*:*:*:*:*:*","cpe:2.3:a:jupyter:notebook:6.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.7.0"},{"fixed":"5.7.11"},{"introduced":"6.4.0"},{"last_affected":"6.4.0"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["6.4.0","5.7.10","v6.4.0","5.7.8","5.7.7","5.7.6","5.7.5","5.7.4","5.7.3","5.7.2","5.7.1","5.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32798.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/jupyterlab/jupyterlab","events":[{"introduced":"8ce37a58199674b1a7a44e2f5cb059465fcef411"},{"last_affected":"8ce37a58199674b1a7a44e2f5cb059465fcef411"}],"database_specific":{"cpe":"cpe:2.3:a:jupyter:notebook:6.4.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"6.4.0"},{"last_affected":"6.4.0"}],"source":"CPE_STRING"}}],"versions":["6.4.0","v4.4.0","@jupyterlab/workspaces@4.4.0","@jupyterlab/workspaces-extension@4.4.0","@jupyterlab/vega5-extension@4.4.0","@jupyterlab/ui-components@4.4.0","@jupyterlab/ui-components-extension@4.4.0","@jupyterlab/translation@4.4.0","@jupyterlab/translation-extension@4.4.0","@jupyterlab/tooltip@4.4.0","@jupyterlab/tooltip-extension@4.4.0","@jupyterlab/toc@6.4.0","@jupyterlab/toc-extension@6.4.0","@jupyterlab/theme-light-extension@4.4.0","@jupyterlab/theme-dark-high-contrast-extension@4.4.0","@jupyterlab/theme-dark-extension@4.4.0","@jupyterlab/testutils@4.4.0","@jupyterlab/testing@4.4.0","@jupyterlab/terminal@4.4.0","@jupyterlab/terminal-extension@4.4.0","@jupyterlab/template@4.4.0","@jupyterlab/statusbar@4.4.0","@jupyterlab/statusbar-extension@4.4.0","@jupyterlab/statedb@4.4.0","@jupyterlab/shortcuts-extension@5.2.0","@jupyterlab/settingregistry@4.4.0","@jupyterlab/settingeditor@4.4.0","@jupyterlab/settingeditor-extension@4.4.0","@jupyterlab/services@7.4.0","@jupyterlab/services-extension@4.4.0","@jupyterlab/running@4.4.0","@jupyterlab/running-extension@4.4.0","@jupyterlab/rendermime@4.4.0","@jupyterlab/rendermime-interfaces@3.12.0","@jupyterlab/rendermime-extension@4.4.0","@jupyterlab/property-inspector@4.4.0","@jupyterlab/pluginmanager@4.4.0","@jupyterlab/pluginmanager-extension@4.4.0","@jupyterlab/pdf-extension@4.4.0","@jupyterlab/outputarea@4.4.0","@jupyterlab/observables@5.4.0","@jupyterlab/notebook@4.4.0","@jupyterlab/notebook-extension@4.4.0","@jupyterlab/nbformat@4.4.0","@jupyterlab/nbconvert-css@4.4.0","@jupyterlab/metapackage@4.4.0","@jupyterlab/metadataform@4.4.0","@jupyterlab/metadataform-extension@4.4.0","@jupyterlab/mermaid@4.4.0","@jupyterlab/mermaid-extension@4.4.0","@jupyterlab/mathjax-extension@4.4.0","@jupyterlab/markedparser-extension@4.4.0","@jupyterlab/markdownviewer@4.4.0","@jupyterlab/markdownviewer-extension@4.4.0","@jupyterlab/mainmenu@4.4.0","@jupyterlab/mainmenu-extension@4.4.0","@jupyterlab/lsp@4.4.0","@jupyterlab/lsp-extension@4.4.0","@jupyterlab/logconsole@4.4.0","@jupyterlab/logconsole-extension@4.4.0","@jupyterlab/launcher@4.4.0","@jupyterlab/launcher-extension@4.4.0","@jupyterlab/json-extension@4.4.0","@jupyterlab/javascript-extension@4.4.0","@jupyterlab/inspector@4.4.0","@jupyterlab/inspector-extension@4.4.0","@jupyterlab/imageviewer@4.4.0","@jupyterlab/imageviewer-extension@4.4.0","@jupyterlab/hub-extension@4.4.0","@jupyterlab/htmlviewer@4.4.0","@jupyterlab/htmlviewer-extension@4.4.0","@jupyterlab/help-extension@4.4.0","@jupyterlab/galata@5.4.0","@jupyterlab/fileeditor@4.4.0","@jupyterlab/fileeditor-extension@4.4.0","@jupyterlab/filebrowser@4.4.0","@jupyterlab/filebrowser-extension@4.4.0","@jupyterlab/extensionmanager@4.4.0","@jupyterlab/extensionmanager-extension@4.4.0","@jupyterlab/documentsearch@4.4.0","@jupyterlab/documentsearch-extension@4.4.0","@jupyterlab/docregistry@4.4.0","@jupyterlab/docmanager@4.4.0","@jupyterlab/docmanager-extension@4.4.0","@jupyterlab/debugger@4.4.0","@jupyterlab/debugger-extension@4.4.0","@jupyterlab/csvviewer@4.4.0","@jupyterlab/csvviewer-extension@4.4.0","@jupyterlab/coreutils@6.4.0","@jupyterlab/console@4.4.0","@jupyterlab/console-extension@4.4.0","@jupyterlab/completer@4.4.0","@jupyterlab/completer-extension@4.4.0","@jupyterlab/codemirror@4.4.0","@jupyterlab/codemirror-extension@4.4.0","@jupyterlab/codeeditor@4.4.0","@jupyterlab/celltags-extension@4.4.0","@jupyterlab/cells@4.4.0","@jupyterlab/cell-toolbar@4.4.0","@jupyterlab/cell-toolbar-extension@4.4.0","@jupyterlab/buildutils@4.4.0","@jupyterlab/builder@4.4.0","@jupyterlab/attachments@4.4.0","@jupyterlab/apputils@4.5.0","@jupyterlab/apputils-extension@4.4.0","@jupyterlab/application@4.4.0","@jupyterlab/application-extension@4.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32798.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797"},{"type":"EVIDENCE","url":"https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}