Read the docs

jupyterlab

Records90All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical16CVSS 9.0–10.0
CVSS high37CVSS 7.0–8.9

Exploited now

jupyterlab records in CISA KEV

No jupyterlab vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Notebook 17 records MEDIUM Jupyter Server 15 records HIGH Jupyterlab 8 records HIGH Jupyterhub 7 records LOW Oauthenticator 5 records MEDIUM Nbconvert 4 records HIGH Enterprise Gateway 3 records HIGH Jupyter Server Proxy 3 records MEDIUM

Records

90 records

TI-2026-78983 CVE-2026-114140 · GHSA-pjvx-prjx-h659

Path traversal in nbconvert lets crafted notebooks write files

Priority HIGH 73

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates.

CVSS 4.0HIGH 8.8 Network Low privileges User interaction EPSS 0.00455 Published 2026-10-21 Partial fix · 7.17.2 CWE-22
TI-2026-39372 CVE-2026-54527 · GHSA-f962-v9hr-pfg5

JupyterLab Git: Stored XSS leading to RCE

Priority HIGH 73

JupyterLab Git is a Git extension for JupyterLab.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.00529 Published 2026-07-08 Partial fix · 0.54.0 CWE-79
TI-2026-05842 CVE-2026-6657

CORS Origin Validation Bypass in jupyter-server

Priority HIGH 71

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05213 Published 2026-06-03 Fix deferred CWE-346
TI-2026-04748 CVE-2026-5422

Path Traversal in jupyter/jupyter

Priority HIGH 70

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.04858 Published 2026-06-02 Fixed CWE-23
TI-2026-05843 CVE-2026-6658 · GHSA-9754-6rhw-gj3h

Cross-site Scripting (XSS) in jupyter/nbconvert

Priority MEDIUM 58

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00161 Published 2026-06-26 Fix deferred CWE-79
TI-2026-30579 CVE-2026-42266 · GHSA-37w4-hwhx-4rc4

Improper input validation in jupyterlab

Priority MEDIUM 49

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05652 Published 2026-05-13 Partial fix · 4.5.7 CWE-602
TI-2024-14988 CVE-2024-22415 · GHSA-4qhp-652w-c22x

Unsecured endpoints in the jupyter-lsp server extension

Priority MEDIUM 49

jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00491 Published 2024-01-18 Fixed in 2.2.2 CWE-23
TI-2021-16545 CVE-2021-39159 · GHSA-9jjr-qqfp-ppwx

Remote code execution in Binderhub

Priority MEDIUM 46

BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01928 Published 2021-08-25 Fixed in 0.2.0-n653, 0.2.0 CWE-94
TI-2024-23295 CVE-2024-35225 · GHSA-fvcq-4x64-hqxr

Jupyter Server Proxy has a reflected XSS issue in host parameter

Priority MEDIUM 43

Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00442 Published 2024-06-11 Fixed in 3.2.4, 4.2.0 CWE-116
TI-2022-18662 CVE-2022-39286 · GHSA-m678-f26j-3hrp

Execution with Unnecessary Privileges in JupyterApp

Priority MEDIUM 43

Jupyter Core is a package for the core common functionality of Jupyter projects.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01449 Published 2022-10-26 Fixed in 4.11.2 CWE-250
Load more
Open these records in search →