jupyter has 4 CVEs on record. 1 was published in the last 90 days. The median CVSS is 8.8 (high). Most affected products: jupyter_server (2), jupyterlab (1), nbviewer (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 1 prev 3
Worst active — by depth score
CVE-2026-35397High· 8.8Jupyter Server is the backend for Jupyter web applications61CVE-2026-42266High· 8.8JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture49CVE-2026-6657High· 8.8A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used48CVE-2026-86258Medium· 5.9nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation33
jupyter vulnerabilities
CVEs affecting jupyter, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-86258Medium· 5.9nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation
nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured …
CVE-2026-6657High· 8.8A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used
A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Ori…
CVE-2026-42266High· 8.8JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_…
CVE-2026-35397High· 8.8PoCJupyter Server is the backend for Jupyter web applications
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whos…