[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCKi42_8m9n6kYf_5Kt3Y26Q8HOcF4Xv24_UHdQ75-qo":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":88,"kevVulnerabilities":150,"topProductsByCves":151,"seoMetadata":162,"meta":171},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":87},16296,"jupyter",14,45,0,525,"2025-09-26","j",[16,22,28,33,39,45,50,56,62,66,70,74,79,84],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},95216,"notebook",70,16,"2024-08-28",{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":11,"last_cve_update":27},95209,"jupyter_server",110,8,"2024-06-06",{"id":29,"product_name":30,"version_count":31,"cve_count":32,"kev_count":11,"last_cve_update":13},95208,"jupyterlab",29,6,{"id":34,"product_name":35,"version_count":36,"cve_count":37,"kev_count":11,"last_cve_update":38},95207,"jupyterhub",53,5,"2024-08-08",{"id":40,"product_name":41,"version_count":42,"cve_count":43,"kev_count":11,"last_cve_update":44},95210,"jupyter_server_proxy",43,3,"2024-06-11",{"id":46,"product_name":47,"version_count":48,"cve_count":43,"kev_count":11,"last_cve_update":49},95217,"oauthenticator",26,"2022-06-09",{"id":51,"product_name":52,"version_count":53,"cve_count":54,"kev_count":11,"last_cve_update":55},95206,"jupyter_core",30,2,"2025-06-03",{"id":57,"product_name":58,"version_count":59,"cve_count":60,"kev_count":11,"last_cve_update":61},95211,"language_server_protocol_integration",25,1,"2024-01-18",{"id":63,"product_name":64,"version_count":37,"cve_count":60,"kev_count":11,"last_cve_update":65},95205,"dockerspawner","2023-12-08",{"id":67,"product_name":68,"version_count":60,"cve_count":60,"kev_count":11,"last_cve_update":69},95204,"binderhub","2021-08-25",{"id":71,"product_name":72,"version_count":60,"cve_count":60,"kev_count":11,"last_cve_update":73},95212,"lti_jupyterhub_authenticator","2025-02-25",{"id":75,"product_name":76,"version_count":77,"cve_count":60,"kev_count":11,"last_cve_update":78},95213,"nbconvert",82,"2022-08-18",{"id":80,"product_name":81,"version_count":82,"cve_count":60,"kev_count":11,"last_cve_update":83},95214,"nbdime",34,"2021-11-03",{"id":85,"product_name":86,"version_count":20,"cve_count":60,"kev_count":11,"last_cve_update":83},95215,"nbdime-jupyterlab","Jupyter is a technology vendor with 14 tracked products and 45 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[89,98,106,112,116,121,128,135,141,146],{"cveId":90,"description":91,"publishedDate":92,"cvssScore":93,"cvssVersion":94,"severity":95,"isKev":96,"epssScore":97},"CVE-2015-6938","Cross-site scripting (XSS) vulnerability in the file browser in notebook\u002Fnotebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.","2015-09-21",4.3,"v2","Medium",false,0.02792,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":102,"cvssVersion":103,"severity":104,"isKev":96,"epssScore":105},"CVE-2021-32797","JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `\u003Cform>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.","2021-08-09",9.6,"v3.1","Critical",0.0266,{"cveId":107,"description":108,"publishedDate":109,"cvssScore":110,"cvssVersion":94,"severity":95,"isKev":96,"epssScore":111},"CVE-2015-7337","The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files\u002F, related to MIME types.","2015-09-29",6.8,0.02487,{"cveId":113,"description":114,"publishedDate":101,"cvssScore":102,"cvssVersion":103,"severity":104,"isKev":96,"epssScore":115},"CVE-2021-32798","The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.",0.02106,{"cveId":117,"description":118,"publishedDate":69,"cvssScore":119,"cvssVersion":103,"severity":104,"isKev":96,"epssScore":120},"CVE-2021-39159","BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration. Users are advised to update to version 0.2.0-n653. If users are unable to update they may disable the git repo provider by specifying the `BinderHub.repo_providers` as a workaround.",9.8,0.01928,{"cveId":122,"description":123,"publishedDate":124,"cvssScore":125,"cvssVersion":103,"severity":126,"isKev":96,"epssScore":127},"CVE-2018-7206","An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)","2018-02-18",8.8,"High",0.01774,{"cveId":129,"description":130,"publishedDate":131,"cvssScore":132,"cvssVersion":133,"severity":95,"isKev":96,"epssScore":134},"CVE-2019-10255","An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.","2019-03-28",6.1,"v3.0",0.01756,{"cveId":136,"description":137,"publishedDate":138,"cvssScore":139,"cvssVersion":133,"severity":95,"isKev":96,"epssScore":140},"CVE-2019-9644","An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.","2019-03-12",5.4,0.01531,{"cveId":142,"description":143,"publishedDate":144,"cvssScore":132,"cvssVersion":133,"severity":95,"isKev":96,"epssScore":145},"CVE-2018-19351","Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook\u002Fnbconvert\u002Fhandlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.","2018-11-18",0.01511,{"cveId":147,"description":148,"publishedDate":78,"cvssScore":139,"cvssVersion":103,"severity":95,"isKev":96,"epssScore":149},"CVE-2021-32862","The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).",0.01476,[],[152,153,154,155,156,157,158,159,160,161],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":11,"last_cve_update":27},{"id":29,"product_name":30,"version_count":31,"cve_count":32,"kev_count":11,"last_cve_update":13},{"id":34,"product_name":35,"version_count":36,"cve_count":37,"kev_count":11,"last_cve_update":38},{"id":40,"product_name":41,"version_count":42,"cve_count":43,"kev_count":11,"last_cve_update":44},{"id":46,"product_name":47,"version_count":48,"cve_count":43,"kev_count":11,"last_cve_update":49},{"id":51,"product_name":52,"version_count":53,"cve_count":54,"kev_count":11,"last_cve_update":55},{"id":57,"product_name":58,"version_count":59,"cve_count":60,"kev_count":11,"last_cve_update":61},{"id":63,"product_name":64,"version_count":37,"cve_count":60,"kev_count":11,"last_cve_update":65},{"id":67,"product_name":68,"version_count":60,"cve_count":60,"kev_count":11,"last_cve_update":69},{"title":163,"metaDescription":164,"keywords":165,"structuredData":166},"Jupyter - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Jupyter covering 14 products with 45 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Jupyter vulnerabilities, Jupyter security, Jupyter CVE, Jupyter threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":167,"@type":168,"name":169,"description":164,"url":170},"https:\u002F\u002Fschema.org","Organization","Jupyter","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fjupyter",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":172,"apiVersion":173},"2026-10-17T22:36:29.692Z","3.0"]