Priority HIGH 71
A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used.
jupyterlab
Records90All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical16CVSS 9.0–10.0
CVSS high37CVSS 7.0–8.9
Exploited now
jupyterlab records in CISA KEVNo jupyterlab vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
15 records in Jupyter Server · all components
TI-2026-04748 CVE-2026-5422
Path Traversal in jupyter/jupyter
Priority HIGH 70
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py.
TI-2026-27533 CVE-2026-35397 · GHSA-5789-5fc7-67v3
jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix
Priority HIGH 68
Jupyter Server is the backend for Jupyter web applications.
TI-2025-38102 CVE-2025-61669 · GHSA-qh7q-6qm3-653w
jupyter_server next parameter open redirect can redirect users to external domains
Priority MEDIUM 61
Jupyter Server is the backend for Jupyter web applications.
TI-2026-32614 CVE-2026-44727 · GHSA-fcw5-x6j4-ccmp
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
Priority MEDIUM 42
Jupyter Server is the backend for Jupyter web applications.
TI-2024-23252 CVE-2024-35178 · GHSA-hrw6-wg82-cm62
Jupyter server on Windows discloses Windows user password hash
Priority MEDIUM 42
The Jupyter Server provides the backend for Jupyter web applications.
TI-2022-11782 CVE-2022-29241 · GHSA-q874-g24w-4q9g
Known or guessable hidden files may be accessed in Jupyter Server
Priority MEDIUM 42
Jupyter Server provides the backend (i.e.
TI-2022-08571 CVE-2022-24757 · GHSA-p737-p57g-4cpr
Sensitive Auth & Cookie data stored in Jupyter server logs
Priority MEDIUM 41
The Jupyter Server provides the backend (i.e.
TI-2026-29587 CVE-2026-40934 · GHSA-5mrq-x3x5-8v8f
jupyter-server authentication cookies remain valid after password reset due to static cookie secret
Priority LOW 35
Jupyter Server is the backend for Jupyter web applications.
TI-2026-28936 CVE-2026-40110 · GHSA-24qx-w28j-9m6p
jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
Priority LOW 35
Jupyter Server is the backend for Jupyter web applications.
TI-2020-16096 CVE-2020-26275 · GHSA-9f66-54xg-pc2c
Open redirect in jupyterlab jupyter_server
Priority LOW 30
The Jupyter Server provides the backend (i.e.
TI-2023-21043 CVE-2023-40170 · GHSA-64x5-55rw-9974
cross-site inclusion (XSSI) of files in jupyter-server
Priority LOW 28
jupyter-server is the backend for Jupyter web applications.
TI-2023-20861 CVE-2023-39968 · GHSA-r726-vmfq-j9j3
Open Redirect Vulnerability in jupyter-server
Priority LOW 28
jupyter-server is the backend for Jupyter web applications.
TI-2020-16053 CVE-2020-26232 · GHSA-grfj-wjv9-4f9v
Open redirect in Jupyter Server
Priority LOW 26
Jupyter Server before version 1.0.6 has an Open redirect vulnerability.
TI-2023-26745 CVE-2023-49080 · GHSA-h56g-gq9v-vc8r
Jupyter Server errors include tracebacks with path information
Priority LOW 22
The Jupyter Server provides the backend (i.e.