`frame-ancestors: self` grants all users access to formgrader in nbgrader
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure, Spoofing
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-668, CWE-1021 and the CVSS impact.
Summary
nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice's page is on the same Origin as the formgrader iframe, Javasript on Alice's page has _full access_ to the contents of the page served by formgrader using Bob's credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jupyterlab | nbgrader | = 0.9.4 | — | No fix listed | CNA |
| — | nbgrader (PyPI) | 0.9.4 to before 0.9.5 | 0.9.5 | Patch available | GHSA-fcr8-4r9f-r66m |
- nbgrader Vendorjupyterlab Affected = 0.9.4 Fixed in — No fix listed CNA
- nbgrader (PyPI) Vendor— Affected 0.9.4 to before 0.9.5 Fixed in 0.9.5 Patch available GHSA-fcr8-4r9f-r66m
Remediation
- Fix · GHSA-fcr8-4r9f-r66m nbgrader (PyPI) Fixed in 0.9.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-23205
- 2026-10-03 Alias added: GHSA-fcr8-4r9f-r66m
References
Other 6
- https://github.com/jupyter/nbgrader/security/advisories/GHSA-fcr8-4r9f-r66m
- https://github.com/jupyter/nbgrader/pull/1915
- https://github.com/jupyter/nbgrader/commit/73e137511ac1dc02e95790d4fd6d4d88dab42325
- https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#:~:text=frame-ancestors
- https://github.com/jupyter/nbgrader
- https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html
More jupyterlab vulnerabilities
- TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
- TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
- TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
- TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
- TI-2026-78983 Path traversal in nbconvert lets crafted notebooks write files CVSS 4.0HIGH 8.8
- TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-23205 · CVE Program
- CVE-2025-23205 · NVD
- FIRST EPSS
- GHSA-fcr8-4r9f-r66m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences