---
id: CVE-2021-41134
aliases:
  - GHSA-p6rw-44q7-3fw4
  - PYSEC-2021-428
title: Stored XSS in Jupyter nbdime
summary: Stored XSS in Jupyter nbdime
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
vendor: nbdime
product: nbdime
ecosystem: pip
affected:
  - nbdime < 1.1.1
  - 'nbdime >= 2.0.0, < 2.1.1'
  - 'nbdime >= 3.0.0, < 3.1.1'
  - nbdime < 5.0.2
  - 'nbdime >= 6.0.0, < 6.1.2'
  - nbdime-jupyterlab < 1.0.1
  - 'nbdime-jupyterlab >= 2.0.0, < 2.1.1'
patched:
  - nbdime 1.1.1
  - nbdime 2.1.1
  - nbdime 3.1.1
  - nbdime 5.0.2
  - nbdime 6.1.2
  - nbdime-jupyterlab 1.0.1
  - nbdime-jupyterlab 2.1.1
published: '2021-11-08'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-p6rw-44q7-3fw4'
references:
  - url: 'https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-41134'
  - url: >-
      https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea
  - url: 'https://github.com/jupyter/nbdime'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nbdime/PYSEC-2021-428.yaml
tags:
  - osv
  - pip
epss: 0.00703
epssPercentile: 0.51265
ingestedAt: '2026-07-08T18:25:51.707Z'
---

## Overview

### Impact

Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.

### Patches

Security patches will be released for each of the major versions of the nbdime packages since version 1.x of the nbdime python package.

#### Python
- nbdime 1.x: Patched in v. 1.1.1
- nbdime 2.x: Patched in v. 2.1.1
- nbdime 3.x: Patched in v. 3.1.1

#### npm
- nbdime 6.x version: Patched in 6.1.2
- nbdime 5.x version: Patched in 5.0.2
- nbdime-jupyterlab 1.x version: Patched in 1.0.1
- nbdime-jupyterlab 2.x version: Patched in 2.1.1

### For more information
If you have any questions or comments about this advisory email us at [security@ipython.org](mailto:security@ipython.org).




## Affected packages

- `nbdime < 1.1.1`
- `nbdime >= 2.0.0, < 2.1.1`
- `nbdime >= 3.0.0, < 3.1.1`
- `nbdime < 5.0.2`
- `nbdime >= 6.0.0, < 6.1.2`
- `nbdime-jupyterlab < 1.0.1`
- `nbdime-jupyterlab >= 2.0.0, < 2.1.1`

## Remediation

Upgrade to a patched release:

- `nbdime 1.1.1`
- `nbdime 2.1.1`
- `nbdime 3.1.1`
- `nbdime 5.0.2`
- `nbdime 6.1.2`
- `nbdime-jupyterlab 1.0.1`
- `nbdime-jupyterlab 2.1.1`