CVE-2025-23205 Details
Description
nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice's page is on the same Origin as the formgrader iframe, Javasript on Alice's page has _full access_ to the contents of the page served by formgrader using Bob's credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).
A vulnerability in Jupyter nbgrader has been identified, allowing users to extract content from the formgrader component by exploiting the Content Security Policy (CSP) frame-ancestors directive. This issue arises when JupyterHub is configured with 'enable_subdomains = False', the default setting. The vulnerability allows a user to craft a page that embeds formgrader in an iframe. When another user visits this page, their credentials are sent, and formgrader is loaded, giving the first user full access to the second user's formgrader content via JavaScript. This vulnerability affects nbgrader version 0.9.4 and has been patched in version 0.9.5.
Users are advised to upgrade to Jupyter nbgrader version 0.9.5. If an upgrade is not possible, the 'frame-ancestors: self' directive can be disabled, or JupyterHub subdomains can be enabled with 'JupyterHub.enable_subdomains = True'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 17, 2025CISA-ADP
Assessed Jan 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jupyter/nbgrader/commit/73e137511ac1dc02e95790d4fd6d4d88dab42325 | [email protected] | Source CodeVendor |
| https://github.com/jupyter/nbgrader/pull/1915 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/jupyter/nbgrader/security/advisories/GHSA-fcr8-4r9f-r66m | [email protected] | AdvisoryRemedyVendor |
| https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#:~:text=frame-ancestors | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-668 | Exposure of Resource to Wrong Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jupyter nbgrader | All versions |
CPE
Remediation
| |
| JupyterHub | 0.9.4 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 17, 2025 | New CVE Received | [email protected] |