CVE-2018-8768
Jupyter Notebook file bypasses sanitization, executes JavaScript
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
CVE-2018-8768- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
CVE-2018-8768- Updated
- 2026-11-02
EUVDEUVD-2018-0106 No score
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
EUVD-2018-0106- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6cwv-x26c-w2q4
Jupyter Notebook file bypasses sanitization, executes JavaScript
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
GHSA-6cwv-x26c-w2q4- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
CVE-2018-8768- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
OSVDEBIAN-CVE-2018-8768
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
DEBIAN-CVE-2018-8768- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-6cwv-x26c-w2q4
Jupyter Notebook file bypasses sanitization, executes JavaScript
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
GHSA-6cwv-x26c-w2q4- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-8768
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
UBUNTU-CVE-2018-8768- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0182 No score
Updated jupyter-notebook packages fix security vulnerability
CVE-2018-8768: In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
MGASA-2018-0182- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11242-1 No score
jupyter-notebook-6.2.0-1.4 on GA media
These are all security issues fixed in the jupyter-notebook-6.2.0-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11242-1- Updated
- 2026-11-02
OSVPYSEC-2018-57 No score
In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
- Record
PYSEC-2018-57- Updated
- 2026-11-02
OSVUSN-4855-1 No score
ipython vulnerability
It was discovered that IPython did not properly sanitize certain input. If a user were tricked into opening a specially crafted notebook file, a remote attacker could possibly use this issue to execute arbitrary code.
- Record
USN-4855-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
notebookPyPI |
before 5.4.1 | 5.4.1 |
ipythonDebian:12 |
before 5.1.0-2 | 5.1.0-2 |
ipythonDebian:13 |
before 5.1.0-2 | 5.1.0-2 |
ipythonDebian:14 |
before 5.1.0-2 | 5.1.0-2 |
jupyter-notebookDebian:12 |
before 5.4.1-1 | 5.4.1-1 |
jupyter-notebookDebian:13 |
before 5.4.1-1 | 5.4.1-1 |
jupyter-notebookDebian:14 |
before 5.4.1-1 | 5.4.1-1 |
jupyter-notebookDebian:9 From an advisory covering 3 CVEs |
before 4.2.3-4+deb9u1, plus listed versions 4.2.3-4 |
4.2.3-4+deb9u1 |
notebookPyPI |
before 5.4.1, plus listed versions 0.0.04.0.04.0.14.0.24.0.4 Show 31 moreShow less4.0.54.0.64.1.04.2.04.2.0b14.2.14.2.24.2.34.3.04.3.14.3.24.4.04.4.15.0.05.0.0b15.0.0b25.0.0rc15.0.0rc25.1.05.1.0rc15.1.0rc25.1.0rc35.2.05.2.0rc15.2.15.2.1rc15.2.25.3.05.3.0rc15.3.15.4.0 |
5.4.1 |
jupyter-notebookMageia:6 |
before 4.2.0-1.1.mga6 | 4.2.0-1.1.mga6 |
ipythonUbuntu:Pro:16.04:LTS |
before 2.4.1-1ubuntu0.1~esm2, plus listed versions 2.3.0-2ubuntu12.3.0-2ubuntu22.4.1-1 |
2.4.1-1ubuntu0.1~esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-8768 is a high vulnerability (CVSS 7.8) in Jupyter Notebook, published March 18, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in notebook 5.4.1.
References
openwall.com/lists/oss-security/2018/03/15/2
lists.debian.org/debian-lts-announce/2020/11/msg00033.html
nvd.nist.gov/vuln/detail/CVE-2018-8768
github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2018-57.yaml
security-tracker.debian.org/tracker/CVE-2018-8768
Show 13 moreShow less
advisories.mageia.org/MGASA-2018-0182.html
bugs.mageia.org/show_bug.cgi?id=22780
ubuntu.com/security/CVE-2018-8768
cve.org/CVERecord?id=CVE-2018-8768
suse.com/security/cve/CVE-2016-6524