Improper Restriction of Rendered UI Layers or Frames Affecting nbgrader package, versions [0.9.4,0.9.5)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-NBGRADER-8647967
- published19 Jan 2025
- disclosed17 Jan 2025
- creditUnknown
Introduced: 17 Jan 2025
NewCVE-2025-23205 (opens in a new tab)How to fix?
Upgrade nbgrader to version 0.9.5 or higher.
Overview
nbgrader is an A system for assigning and grading notebooks
Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames due to the improper configuration of the frame-ancestors directive. An attacker can extract sensitive content by crafting malicious links that embed the vulnerable page in an IFrame, exploiting the same-origin access to execute scripts and extract data.
Workaround
This vulnerability can be mitigated by disabling frame-ancestors: self, or enabling per-user and per-service subdomains with JupyterHub.enable_subdomains = True.