CVE-2015-7337
Improper Input Validation in Jupyter Notebook
CVE-2015-7337 is a medium vulnerability (CVSS 6.8) in Ipython Notebook, published September 29, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. Fixed in notebook 4.0.5.
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
Exploit likelihood
What each source reports
NVD Score used
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
CVE-2015-7337- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
CVE-2015-7337- Updated
- 2026-11-02
EUVDEUVD-2015-0024 No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
EUVD-2015-0024- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92mr-v722-f48m
Improper Input Validation in Jupyter Notebook
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
GHSA-92mr-v722-f48m- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-92mr-v722-f48m
Improper Input Validation in Jupyter Notebook
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
GHSA-92mr-v722-f48m- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2015-25 No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
PYSEC-2015-25- Updated
- 2026-11-02
OSVPYSEC-2015-27 No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
PYSEC-2015-27- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7337 No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
UBUNTU-CVE-2015-7337- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
notebookPyPI |
4.0.0 to 4.0.4 | 4.0.5 |
ipythonPyPI |
through 3.2.1 | 3.2.2 |
notebookPyPI |
4.0.0 up to 4.0.5, plus listed versions 4.0.14.0.24.0.4 |
4.0.5 |
ipythonPyPI |
before 3.2.2, plus listed versions 0.100.10.10.10.20.110.12 Show 44 moreShow less0.12.10.130.13.10.13.20.6.100.6.110.6.120.6.130.6.140.6.150.6.40.6.50.6.60.6.70.6.80.6.90.7.00.7.10.7.1.fix10.7.20.7.30.7.4.svn.r20100.8.00.8.10.8.20.8.30.8.40.90.9.11.0.01.1.01.2.01.2.12.0.02.1.02.2.02.3.02.3.12.4.02.4.13.0.03.1.03.2.03.2.1 |
3.2.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
security.gentoo.org/glsa/201512-02
bugzilla.redhat.com/show_bug.cgi?id=1264067
seclists.org/oss-sec/2015/q3/558
github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967
lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-7337
ubuntu.com/security/CVE-2015-7337
openwall.com/lists/oss-security/2015/09/16/3
cve.org/CVERecord?id=CVE-2015-7337