CVE catalog

CVE-2015-6938

ipython affected and fixed versions

[CVE catalog]

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.79% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixieipython2.4.1-1FixedDistribution-reported fixed boundary[CVE-2015-6938]
Debiantrixieipython8.35.0-1Fixed[CVE-2015-6938]
Debiansidipython2.4.1-1FixedDistribution-reported fixed boundary[CVE-2015-6938]
Debiansidipython9.11.0-3Fixed[CVE-2015-6938]
Debianforkyipython2.4.1-1FixedDistribution-reported fixed boundary[CVE-2015-6938]
Debianforkyipython9.11.0-3Fixed[CVE-2015-6938]
Debianbookwormipython2.4.1-1FixedDistribution-reported fixed boundary[CVE-2015-6938]
Debianbookwormipython8.5.0-4Fixed[CVE-2015-6938]
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormipython2.4.1-1FixedDistribution-reported fixed boundary[CVE-2015-6938]
Debianbookwormipython8.5.0-4Fixed[CVE-2015-6938]
Debianforkyipython2.4.1-1FixedDistribution-reported fixed boundary[CVE-2015-6938]
Debianforkyipython9.11.0-3Fixed[CVE-2015-6938]
Debiansidipython2.4.1-1FixedDistribution-reported fixed boundary[CVE-2015-6938]
Debiansidipython9.11.0-3Fixed[CVE-2015-6938]
Debiantrixieipython2.4.1-1FixedDistribution-reported fixed boundary[CVE-2015-6938]
Debiantrixieipython8.35.0-1Fixed[CVE-2015-6938]
Original provider fields
{
  "package_releases": [
    {
      "name": "ipython",
      "status": "fixed",
      "release": "sid",
      "version": "9.11.0-3"
    },
    {
      "name": "ipython",
      "status": "fixed",
      "release": "forky",
      "version": "9.11.0-3"
    },
    {
      "name": "ipython",
      "status": "fixed",
      "release": "trixie",
      "version": "8.35.0-1"
    },
    {
      "name": "ipython",
      "status": "fixed",
      "release": "bookworm",
      "version": "8.5.0-4"
    }
  ],
  "fixed_versions": [
    {
      "bug": 798886,
      "name": "ipython",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "low",
      "fixed_version": "2.4.1-1"
    },
    {
      "bug": 798886,
      "name": "ipython",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "low",
      "fixed_version": "2.4.1-1"
    },
    {
      "bug": 798886,
      "name": "ipython",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "low",
      "fixed_version": "2.4.1-1"
    },
    {
      "bug": 798886,
      "name": "ipython",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "low",
      "fixed_version": "2.4.1-1"
    }
  ],
  "distribution_packages": []
}

[Debian bug #798886]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [ipython3]Unknown

    Source package: [ipython]

    Details (2)

    • 8.5.0-4 · all · bookworm

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · bookworm; dsa · ipython · debian · 12

    • 8.5.0-4 · all · bookworm

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · bookworm; dsa · ipython · debian · 12

  • [python3-ipython]Unknown

    Source package: [ipython]

    Details (2)

    • 8.5.0-4 · all · bookworm

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · bookworm; dsa · ipython · debian · 12

    • 8.5.0-4 · all · bookworm

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · bookworm; dsa · ipython · debian · 12

  • [python-ipython-doc]Unknown

    Source package: [ipython]

    Details (2)

    • 8.5.0-4 · all · bookworm

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · bookworm; dsa · ipython · debian · 12

    • 8.5.0-4 · all · bookworm

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · bookworm; dsa · ipython · debian · 12

[Debian 13 (Trixie)]

  • [ipython3]Unknown

    Source package: [ipython]

    Details (2)

    • 8.35.0-1 · all · trixie

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · 13

    • 8.35.0-1 · all · trixie

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · 13

  • [python3-ipython]Unknown

    Source package: [ipython]

    Details (2)

    • 8.35.0-1 · all · trixie

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · 13

    • 8.35.0-1 · all · trixie

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · 13

  • [python-ipython-doc]Unknown

    Source package: [ipython]

    Details (2)

    • 8.35.0-1 · all · trixie

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · 13

    • 8.35.0-1 · all · trixie

      Fixed · Fixed: 2.4.1-1

      dsa · ipython · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]