CVE-2021-32798

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

• CWE-79
• CWE-79

• https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5Exploit, Third Party Advisory
• https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797Third Party Advisory
• https://github.com/jupyter/notebook/commit/79fc76e890a8ec42f73a3d009e44ef84c14ef0d5Exploit, Third Party Advisory
• https://github.com/jupyter/notebook/security/advisories/GHSA-hwvq-6gjx-j797Third Party Advisory

Published

Aug 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32792mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-32793Pi-hole's Web interface provides a central location to manag…4.8
• CVE-2021-32794ArchiSteamFarm is a C# application with primary purpose of i…7.5
• CVE-2021-32795ArchiSteamFarm is a C# application with primary purpose of i…5.9
• CVE-2021-32796xmldom is an open source pure JavaScript W3C standard-based …5.3
• CVE-2021-32797JupyterLab is a user interface for Project Jupyter which wil…9.6
• CVE-2021-32800Nextcloud server is an open source, self hosted personal clo…8.1
• CVE-2021-32801Nextcloud server is an open source, self hosted personal clo…5.5
• CVE-2021-32802Nextcloud server is an open source, self hosted personal clo…9.8
• CVE-2021-32803The npm package "tar" (aka node-tar) before versions 6.1.2, …8.1
• CVE-2021-32804The npm package "tar" (aka node-tar) before versions 6.1.1, …8.1
• CVE-2021-32805Flask-AppBuilder is an application development framework, bu…6.1