Security: jupyter-server/jupyter_server
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
5xx request logging leaks token-bearing Referer header valuesGHSA-c3mw-737p-c7g2 published
Aug 28, 2026 by Yann-PHigh -
Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSPGHSA-fcw5-x6j4-ccmp published
Jun 17, 2026 by Yann-PHigh -
CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`GHSA-24qx-w28j-9m6p published
May 5, 2026 by Yann-PModerate -
Path traversal via jupyter-server REST API allows access to a subset of directories sibling to the `root_dir`GHSA-5789-5fc7-67v3 published
May 5, 2026 by Yann-PHigh -
Authentication Cookies Remain Valid After Password Reset and Server RestartGHSA-5mrq-x3x5-8v8f published
May 5, 2026 by Yann-PModerate -
Open redirection vulnerability in `next` query parameterGHSA-qh7q-6qm3-653w published
May 5, 2026 by Yann-PModerate -
Jupyter server on Windows discloses Windows user password hashGHSA-hrw6-wg82-cm62 published
Jun 6, 2024 by blink1073High -
Server errors include tracebacks with path informationGHSA-h56g-gq9v-vc8r published
Dec 4, 2023 by blink1073Low -
cross-site inclusion (XSSI) of filesGHSA-64x5-55rw-9974 published
Aug 28, 2023 by ZsailerModerate -
Open Redirect VulnerabilityGHSA-r726-vmfq-j9j3 published
Aug 28, 2023 by ZsailerModerate