CVE request: maliciously crafted notebook files in Jupyter

[Thomas Kluyver <thomas () kluyver me uk>]

Email address of requester: security () ipython org, thomas () kluyver me uk, benjaminrk () gmail com, jkamens () 
quantopian com, ssanderson () quantopian com

Software name: Jupyter Notebook (formerly IPython Notebook)
Type of vulnerability: Maliciously forged file
Attack outcome: Possible remote execution

Vulnerability: A maliciously forged notebook file can bypass sanitization to execute Javascript in the notebook 
context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

Affected versions:

- notebook ≤ 5.4.0

URI with issues:

- GET /notebook/**

Patches:  not yet finalised

Mitigations:

Upgrade to Jupyter notebook 5.4.1 or 5.5 once available.
If using pip,

    pip install --upgrade notebook

For conda:

    conda update conda
    conda update notebook

Vulnerability reported by vkgonka () mail ru , via Jonathan Kamens at Quantopian