Jupyter Jupyter vulnerabilities
3 known vulnerabilities affecting jupyter/jupyter_jupyter.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2026-6657P2HIGHCVSS 8.8≥ unspecified, ≤ latest2026-06-03
CVE-2026-6657 [HIGH] CWE-346 CVE-2026-6657: A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS o
A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This allows attacker-controlled domains such as `trusted.e
nvd
CVE-2026-5422P2HIGHCVSS 8.1≥ unspecified, ≤ latest2026-06-02
CVE-2026-5422 [HIGH] CWE-23 CVE-2026-5422: A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root dire
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as roo
nvd
CVE-2026-6658P4MEDIUMCVSS 5.4≥ unspecified, ≤ latest2026-06-26
CVE-2026-6658 [MEDIUM] CWE-79 CVE-2026-6658: A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via un
A vulnerability in jupyter/nbconvert versions ` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.
nvd