Jupyter Server errors include tracebacks with path information
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-209.
Summary
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jupyterlab | jupyter_server | before 2.11.2 | 2.11.2 | Patch available | CNA |
| — | jupyter-server (PyPI) | before 2.11.2 | 2.11.2 | Patch available | GHSA-h56g-gq9v-vc8r |
- jupyter_server Vendorjupyterlab Affected before 2.11.2 Fixed in 2.11.2 Patch available CNA
- jupyter-server (PyPI) Vendor— Affected before 2.11.2 Fixed in 2.11.2 Patch available GHSA-h56g-gq9v-vc8r
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:* | before 2.11.2 | Vulnerable | jupyterlab |
- cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:* Versions before 2.11.2 Vulnerable ·jupyterlab
Remediation
- Fix · CNA jupyter_server (jupyter-server) Fixed in 2.11.2
- Fix · GHSA-h56g-gq9v-vc8r jupyter-server (PyPI) Fixed in 2.11.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-49080
- 2026-10-03 Alias added: GHSA-h56g-gq9v-vc8r
References
Patch 1
Advisory 2
Other 6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/62LO7PPIAMLIDEKUOORXLHKLGA6QPL77/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FG2JWZI5KPUYMDPS53AIFTZJWZD3IT6I/
- https://github.com/jupyter-server/jupyter_server
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2023-272.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/62LO7PPIAMLIDEKUOORXLHKLGA6QPL77
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FG2JWZI5KPUYMDPS53AIFTZJWZD3IT6I
More jupyterlab Jupyter Server vulnerabilities
- TI-2026-05842 CORS Origin Validation Bypass in jupyter-server CVSS 3.1HIGH 8.8
- TI-2026-04748 Path Traversal in jupyter/jupyter CVSS 3.1HIGH 8.1
- TI-2026-27533 jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix CVSS 4.0HIGH 7.6
- TI-2025-38102 jupyter_server next parameter open redirect can redirect users to external domains CVSS 4.0MEDIUM 6.3
- TI-2026-32614 Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP CVSS 4.0CRITICAL 9.3
- TI-2024-23252 Jupyter server on Windows discloses Windows user password hash CVSS 3.1HIGH 7.5
Sources
- CVE-2023-49080 · CVE Program
- CVE-2023-49080 · NVD
- FIRST EPSS
- GHSA-h56g-gq9v-vc8r · GitHub Advisory Database · CC BY 4.0
- CVE-2023-49080 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences