CVE-2018-21030

CVE-2018-21030 describes a cross-site scripting (XSS) vulnerability in Jupyter Notebook versions prior to 5.5.0, where the application fails to utilize a Content Security Policy (CSP) header. This oversight allows an attacker to embed malicious XSS payloads within served files, such as SVG documents, which are then executed in the context of the user's browser. The vulnerability has a CVSSv3 score of 5.3 (MEDIUM), indicating a network-based attack with low complexity, requiring no privileges or user interaction, and primarily impacting integrity. While the EPSS score is low, suggesting a minimal likelihood of exploitation, the lack of a CSP header presents a clear security weakness. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting it has not garnered significant attention from researchers or the public.