CVE-2021-32798: Jupyter Notebook

Critical severity, CVSS 9.6. EPSS: 2.1% chance of exploitation in the next 30 days.

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

Affected products

• Jupyter Notebook: from 5.7.0, before 5.7.11 (fixed in 5.7.11); version 6.4.0 only

Published 2021-08-09. Last modified 2026-06-17.