https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:49:44 +0000 https://cve.radiocsirt.org/vuln/cve-2025-23205 <p><strong>Affected:</strong> jupyter nbgrader</p> <p>nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: &#39;self&#39; grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice&#39;s page is on the same Origin as the formgrader iframe, Javasript on Alice&#39;s page has _full access_ to the contents of the page served by formgrader using Bob&#39;s credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).</p> <p><strong>Affected:</strong> jupyter nbgrader</p> <p>nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: &#39;self&#39; grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice&#39;s page is on the same Origin as the formgrader iframe, Javasript on Alice&#39;s page has _full access_ to the contents of the page served by formgrader using Bob&#39;s credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).</p> https://cve.radiocsirt.org/vuln/cve-2025-23205