PT-2022-10098 · Nbconvert+2 · Nconvert+2

Alvaro Muñoz · Published 2022-08-10 · Updated 2024-09-02 · CVE-2021-32862

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nbconvert version 5.5.0

Description The GitHub Security Lab discovered a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML, which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server. The vulnerability can be exploited through various means, including the notebook.metadata.language info.pygments lexer field, notebook.metadata.title node, notebook.metadata.widgets node, notebook.cell.metadata.tags nodes, and other output data mime types such as text/html, image/svg+xml, text/markdown, and application/javascript.

Recommendations As a temporary workaround, consider disabling the use of nbconvert to generate HTML notebooks until a patch is available. Restrict access to the vulnerable nbconvert module to minimize the risk of exploitation. Avoid using user-controllable notebooks with nbconvert until the issue is resolved. Update to a newer version of nbconvert that contains a fix for this vulnerability, if available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2022-3366

CVE-2021-32862

DLA-3442-1

DLA-3863-1

GHSA-9JMQ-RX5F-8JWQ

GHSA-H274-FCVJ-H2WM

PYSEC-2022-249

Affected Products

Alt Linux

Astra Linux

Nconvert

References · 20

• 🔥 https://github.com/jupyter/nbconvert/security/advisories/GHSA-9jmq-rx5f-8jwq · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-32862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32862 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32862 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3442-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3863-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32862 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32862 · Security Note
• https://osv.dev/vulnerability/GHSA-9jmq-rx5f-8jwq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-249 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32862 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32862 · Vendor Advisory
• https://github.com/jupyter/nbviewer/security/advisories/GHSA-h274-fcvj-h2wm · Note
• https://github.com/jupyter/nbconvert · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nbconvert/PYSEC-2022-249.yaml · Note