CVE-2023-40170Medium· 4.6▾ Sunlitcross-site inclusion (XSSI) of files in jupyter-server
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab".
Jupyter Server 2.7.2
Use lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.
Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.
Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
jupyter-server < 2.7.2Upgrade to a patched release:
jupyter-server 2.7.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-39968Medium· 6.1Open Redirect Vulnerability in jupyter-server
CVE-2025-61669MediumJupyter Server has an open redirection vulnerability in `next` query parameter
CVE-2022-29241High· 7.1Jupyter server Token bruteforcing
CVE-2024-35178High· 7.5Jupyter server on Windows discloses Windows user password hash
CVE-2023-49080Medium· 4.3jupyter-server errors include tracebacks with path information
CVE-2020-26232Medium· 4.1Open redirect in Jupyter Server