Converting Jupyter Notebooks (.ipynb files) to other formats. Output formats include asciidoc, html, latex, markdown, pdf, py, rst, script. nbconvert can be used both as a Python library (`import nbconvert`) or as a command line tool (invoked as `jupyter nbconvert ...`).
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).
CVE-2021-32862 - Medium Severity Vulnerability
Vulnerable Library - nbconvert-5.6.1-py2.py3-none-any.whl
Converting Jupyter Notebooks (.ipynb files) to other formats. Output formats include asciidoc, html, latex, markdown, pdf, py, rst, script. nbconvert can be used both as a Python library (`import nbconvert`) or as a command line tool (invoked as `jupyter nbconvert ...`).
Library home page: https://files.pythonhosted.org/packages/79/6c/05a569e9f703d18aacb89b7ad6075b404e8a4afde2c26b73ca77bb644b14/nbconvert-5.6.1-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-scm/Container-Security-With-JenkinsCI/requirements.txt
Path to vulnerable library: /tmp/ws-scm/Container-Security-With-JenkinsCI/requirements.txt
Dependency Hierarchy: - notebook-5.4.0-py2.py3-none-any.whl (Root Library) - :x: **nbconvert-5.6.1-py2.py3-none-any.whl** (Vulnerable Library)
Found in base branch: master
Vulnerability Details
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).
Publish Date: 2022-08-18
URL: CVE-2021-32862
CVSS 3 Score Details (5.4)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-9jmq-rx5f-8jwq
Release Date: 2022-08-18
Fix Resolution (nbconvert): 6.3.0
Direct dependency fix Resolution (notebook): 5.4.1
Step up your Open Source Security Game with Mend here