CVE-2015-7337
Improper Input Validation in Jupyter Notebook
CVE-2015-7337 is a medium vulnerability (CVSS 6.8) in Ipython Notebook, published September 29, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. Fixed in notebook 4.0.5.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 2.49%EPSS, 84th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.0.5notebook +3 more
Description
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
notebookPyPI | 4.0.0 to 4.0.4 | 4.0.5 |
ipythonPyPI | through 3.2.1 | 3.2.2 |
notebookPyPI | 4.0.0 up to 4.0.5, plus listed versions 4.0.14.0.24.0.4 | 4.0.5 |
ipythonPyPI | before 3.2.2, plus listed versions 0.100.10.10.10.20.110.12 Show 44 moreShow less0.12.10.130.13.10.13.20.6.100.6.110.6.120.6.130.6.140.6.150.6.40.6.50.6.60.6.70.6.80.6.90.7.00.7.10.7.1.fix10.7.20.7.30.7.4.svn.r20100.8.00.8.10.8.20.8.30.8.40.90.9.11.0.01.1.01.2.01.2.12.0.02.1.02.2.02.3.02.3.12.4.02.4.13.0.03.1.03.2.03.2.1 | 3.2.2 |
What each source reports
NVD Score used
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
CVE-2015-7337- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
CVE-2015-7337- Updated
- 2026-11-02
EUVDEUVD-2015-0024No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
EUVD-2015-0024- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92mr-v722-f48m
Improper Input Validation in Jupyter Notebook
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
GHSA-92mr-v722-f48m- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-92mr-v722-f48m
Improper Input Validation in Jupyter Notebook
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
GHSA-92mr-v722-f48m- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2015-25No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
PYSEC-2015-25- Updated
- 2026-11-02
OSVPYSEC-2015-27No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
PYSEC-2015-27- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7337No score
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
- Record
UBUNTU-CVE-2015-7337- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
security.gentoo.org/glsa/201512-02
bugzilla.redhat.com/show_bug.cgi?id=1264067
seclists.org/oss-sec/2015/q3/558
github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967
lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-7337
ubuntu.com/security/CVE-2015-7337
openwall.com/lists/oss-security/2015/09/16/3
cve.org/CVERecord?id=CVE-2015-7337