CVE-2015-6938
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
CVE-2015-6938 is a medium vulnerability (CVSS 4.3) in Ipython Notebook, published September 15, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.79%, the 86th percentile. Fixed in notebook 4.0.5.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 2.79%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.0.5notebook +8 more
Description
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
notebookPyPI | 4.0.0 to 4.0.4 | 4.0.5 |
ipythonPyPI | through 3.2.1 | 3.2.2 |
ipythonDebian:12 | before 2.4.1-1 | 2.4.1-1 |
ipythonDebian:13 | before 2.4.1-1 | 2.4.1-1 |
ipythonDebian:14 | before 2.4.1-1 | 2.4.1-1 |
notebookPyPI | 4.0.0 up to 4.0.5, plus listed versions 4.0.14.0.24.0.4 | 4.0.5 |
ipythonPyPI | before 3.2.2, plus listed versions 0.100.10.10.10.20.110.12 Show 44 moreShow less0.12.10.130.13.10.13.20.6.100.6.110.6.120.6.130.6.140.6.150.6.40.6.50.6.60.6.70.6.80.6.90.7.00.7.10.7.1.fix10.7.20.7.30.7.4.svn.r20100.8.00.8.10.8.20.8.30.8.40.90.9.11.0.01.1.01.2.01.2.12.0.02.1.02.2.02.3.02.3.12.4.02.4.13.0.03.1.03.2.03.2.1 | 3.2.2 |
ipythonMageia:4 | before 2.3.0-1.2.mga4 | 2.3.0-1.2.mga4 |
ipythonMageia:5 | before 2.3.0-2.3.mga5 | 2.3.0-2.3.mga5 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
CVE-2015-6938- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
CVE-2015-6938- Updated
- 2026-11-02
EUVDEUVD-2015-0023No score
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
EUVD-2015-0023- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4vwq-x64q-j4cj
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
GHSA-4vwq-x64q-j4cj- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-4vwq-x64q-j4cj
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
GHSA-4vwq-x64q-j4cj- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
CVE-2015-6938- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2015-6938No score
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
DEBIAN-CVE-2015-6938- Updated
- 2026-11-02
OSVMGASA-2015-0372No score
Updated ipython packages fix CVE-2015-6938
Updated ipython packages fix security vulnerability:
In IPython, local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it (CVE-2015-6938).
- Record
MGASA-2015-0372- Updated
- 2026-11-02
OSVPYSEC-2015-24No score
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
PYSEC-2015-24- Updated
- 2026-11-02
OSVPYSEC-2015-26No score
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
PYSEC-2015-26- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-6938No score
Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
- Record
UBUNTU-CVE-2015-6938- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2015-10/msg00016.html
github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892
bugzilla.redhat.com/show_bug.cgi?id=1259405
seclists.org/oss-sec/2015/q3/474
Show 14 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html
nvd.nist.gov/vuln/detail/CVE-2015-6938
security-tracker.debian.org/tracker/CVE-2015-6938
advisories.mageia.org/MGASA-2015-0372.html
bugs.mageia.org/show_bug.cgi?id=16686
openwall.com/lists/oss-security/2015/09/14/2
ubuntu.com/security/CVE-2015-6938
cve.org/CVERecord?id=CVE-2015-6938