CVE-2023-49080Medium· 4.3▾ Sunlitjupyter-server errors include tracebacks with path information
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
Unhandled errors in API requests include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment.
jupyter-server PATCHED_VERSION no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty.
None
jupyter-server < 2.11.2Upgrade to a patched release:
jupyter-server 2.11.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-39968Medium· 6.1Open Redirect Vulnerability in jupyter-server
CVE-2025-61669MediumJupyter Server has an open redirection vulnerability in `next` query parameter
CVE-2022-29241High· 7.1Jupyter server Token bruteforcing
CVE-2024-35178High· 7.5Jupyter server on Windows discloses Windows user password hash
CVE-2020-26232Medium· 4.1Open redirect in Jupyter Server
CVE-2023-40170Medium· 4.6cross-site inclusion (XSSI) of files in jupyter-server