Jupyter Server vulnerabilities

3 known vulnerabilities in Jupyter Server from Jupyter. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  jupyter/jupyter: Origin Validation Error

  CVE-2026-6657Jun 3, 2026JupyterEPSS 5.21%

  A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only

• 8.1 High severity

  jupyter/jupyter: Relative Path Traversal

  CVE-2026-5422Jun 2, 2026JupyterEPSS 4.86%

  A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trail

• 7.5 High severity

  jupyter_server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-35178Jun 6, 2024Jupyter-server

  The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this pas