CVE-2023-51277: Critical Debug Entitlement in nbviewer-app Before 0.1.6

CVE-2023-51277 is a critical severity (CVSS 9.8 in NVD) issue in nbviewer-app, also called Jupyter Notebook Viewer, a macOS app. Versions before 0.1.6 shipped release builds with the get-task-allow entitlement. The fix is version 0.1.6, which avoids that entitlement for release builds.

What's affected

The NVD description says nbviewer-app before 0.1.6 has the get-task-allow entitlement for release builds. The record lists the product as a macOS application.

The upstream compare view between 0.1.5 and 0.1.6 shows three commits from 15 December 2023, one titled Avoid get-task-allow entitlement for release builds, linking to Apple's notarization guidance. The file-level diff did not load for me, so I cannot describe the exact change. The project's fix is therefore version 0.1.6 or later.

There is no separate vendor advisory in the references, and the 9.8 score is NVD's. It is worth reading as a configuration weakness rated at the top of the scale rather than as a described remote attack.

CVSS for this entry is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How to check if you're exposed

Check the version of the app in Finder or from the command line.

mdls -name kMDItemVersion /Applications/nbviewer-app.app
codesign -d --entitlements - /Applications/nbviewer-app.app

The first command prints the installed version. The second lists the entitlements the app was signed with, where get-task-allow would appear if present. Adjust the path if you installed the app elsewhere.

What to do now

1. Check the installed version of nbviewer-app on every Mac where it is used.
2. Update to 0.1.6 or later from the project's releases.
3. If you cannot update, stop using the app until you can, and open notebooks in another viewer.
4. If you distribute your own macOS builds, check that release builds do not carry get-task-allow, as Apple's notarization guidance describes.
5. Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.

Why it matters

The record lists no CWE for this entry, so the class of weakness is described only by the vendor or researcher text in the sources below.

The record lists no CWE. The get-task-allow entitlement is meant for debug builds, because it lets other processes attach a debugger to the app. Apple's notarization documentation, which the project linked from its fix, covers it among common notarization issues. Left in a release build, it widens what another process on the same Mac can do to the app.

That is why this reads differently from a typical code flaw. There is no parser bug here, only a build setting. The 9.8 rating stems from the NVD vector, which assumes a network attacker with no privileges. I would weigh it against how the app is used before treating it as an emergency.

The record does not mark exploitation.

The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.

Quick check

Sources

• Upstream compare view 0.1.5 to 0.1.6
• Fix commit listed in the NVD record
• Apple notarization guidance listed in the NVD record

Last reviewed: 19 October 2026.