7.5
High
CVE-2021-32862 The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert
Description
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| nbconvert 6.2 | earliest → 6.2 | No fix stated |
References
- github.com github.com
- github.com github.com
- [debian-lts-announce] 20230603 [SECURITY] [DLA 3442-1] nbconvert security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of nbconvert
The 5 CVEs of nbconvert →
CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates
8.8
High
CVE-2026-39378
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates
6.5
Medium
CVE-2026-39377
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates
6.5
Medium
CVE-2025-53000
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates
8.5
High