{"id":"CVE-2021-41134","aliases":["GHSA-p6rw-44q7-3fw4","PYSEC-2021-428"],"title":"Stored XSS in Jupyter nbdime","summary":"Stored XSS in Jupyter nbdime","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","vendor":"nbdime","product":"nbdime","ecosystem":"pip","affected":["nbdime < 1.1.1","nbdime >= 2.0.0, < 2.1.1","nbdime >= 3.0.0, < 3.1.1","nbdime < 5.0.2","nbdime >= 6.0.0, < 6.1.2","nbdime-jupyterlab < 1.0.1","nbdime-jupyterlab >= 2.0.0, < 2.1.1"],"patched":["nbdime 1.1.1","nbdime 2.1.1","nbdime 3.1.1","nbdime 5.0.2","nbdime 6.1.2","nbdime-jupyterlab 1.0.1","nbdime-jupyterlab 2.1.1"],"published":"2021-11-08","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-p6rw-44q7-3fw4","references":[{"url":"https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41134"},{"url":"https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea"},{"url":"https://github.com/jupyter/nbdime"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nbdime/PYSEC-2021-428.yaml"}],"tags":["osv","pip"],"epss":0.00703,"epssPercentile":0.51193,"ingestedAt":"2026-07-08T18:25:51.707Z","slug":"CVE-2021-41134","body":"## Overview\n\n### Impact\n\nImproper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.\n\n### Patches\n\nSecurity patches will be released for each of the major versions of the nbdime packages since version 1.x of the nbdime python package.\n\n#### Python\n- nbdime 1.x: Patched in v. 1.1.1\n- nbdime 2.x: Patched in v. 2.1.1\n- nbdime 3.x: Patched in v. 3.1.1\n\n#### npm\n- nbdime 6.x version: Patched in 6.1.2\n- nbdime 5.x version: Patched in 5.0.2\n- nbdime-jupyterlab 1.x version: Patched in 1.0.1\n- nbdime-jupyterlab 2.x version: Patched in 2.1.1\n\n### For more information\nIf you have any questions or comments about this advisory email us at [security@ipython.org](mailto:security@ipython.org).\n\n\n\n\n## Affected packages\n\n- `nbdime < 1.1.1`\n- `nbdime >= 2.0.0, < 2.1.1`\n- `nbdime >= 3.0.0, < 3.1.1`\n- `nbdime < 5.0.2`\n- `nbdime >= 6.0.0, < 6.1.2`\n- `nbdime-jupyterlab < 1.0.1`\n- `nbdime-jupyterlab >= 2.0.0, < 2.1.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nbdime 1.1.1`\n- `nbdime 2.1.1`\n- `nbdime 3.1.1`\n- `nbdime 5.0.2`\n- `nbdime 6.1.2`\n- `nbdime-jupyterlab 1.0.1`\n- `nbdime-jupyterlab 2.1.1`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}