Every CVE Search/ Get API key

CVE-2015-6938

Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

4.3 MediumFix available

CVE-2015-6938 is a medium vulnerability (CVSS 4.3) in Ipython Notebook, published September 15, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.79%, the 86th percentile. Fixed in notebook 4.0.5.

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Exploit likelihood

2.79%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
CVE-2015-6938
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
CVE-2015-6938
Updated
2026-11-02
EUVDEUVD-2015-0023 No score

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
EUVD-2015-0023
Updated
2026-11-03
GitHub AdvisoriesGHSA-4vwq-x64q-j4cj 5.3

Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
GHSA-4vwq-x64q-j4cj
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-4vwq-x64q-j4cj 5.3

Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
GHSA-4vwq-x64q-j4cj
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
CVE-2015-6938
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2015-6938 No score

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
DEBIAN-CVE-2015-6938
Updated
2026-11-02
OSVMGASA-2015-0372 No score

Updated ipython packages fix CVE-2015-6938

Updated ipython packages fix security vulnerability:

In IPython, local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it (CVE-2015-6938).

Record
MGASA-2015-0372
Updated
2026-11-02
OSVPYSEC-2015-24 No score

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
PYSEC-2015-24
Updated
2026-11-02
OSVPYSEC-2015-26 No score

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
PYSEC-2015-26
Updated
2026-11-02
OSVUBUNTU-CVE-2015-6938 No score

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Record
UBUNTU-CVE-2015-6938
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
notebook
PyPI
 4.0.0 to 4.0.4
4.0.5
ipython
PyPI
 through 3.2.1
3.2.2
ipython
Debian:12
 before 2.4.1-1
2.4.1-1
ipython
Debian:13
 before 2.4.1-1
2.4.1-1
ipython
Debian:14
 before 2.4.1-1
2.4.1-1
notebook
PyPI
 4.0.0 up to 4.0.5, plus listed versions
4.0.14.0.24.0.4
4.0.5
ipython
PyPI
 before 3.2.2, plus listed versions
0.100.10.10.10.20.110.12
Show 44 moreShow less
0.12.10.130.13.10.13.20.6.100.6.110.6.120.6.130.6.140.6.150.6.40.6.50.6.60.6.70.6.80.6.90.7.00.7.10.7.1.fix10.7.20.7.30.7.4.svn.r20100.8.00.8.10.8.20.8.30.8.40.90.9.11.0.01.1.01.2.01.2.12.0.02.1.02.2.02.3.02.3.12.4.02.4.13.0.03.1.03.2.03.2.1
3.2.2
ipython
Mageia:4
 before 2.3.0-1.2.mga4
2.3.0-1.2.mga4
ipython
Mageia:5
 before 2.3.0-2.3.mga5
2.3.0-2.3.mga5

History

History
WhenChangedSources
2026-11-03affected
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open