Vulnerability · Published Sep 6, 2026 · Assigned by VulnCheck

CVE-2026-86258nbviewer through 1.0.1 Path Traversal via LocalFileHandler

Medium 5.9

In plain English

A medium-severity path traversal in nbviewer from jupyter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 55.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.

Affected products (as reported)

Vendor	Product	Versions
jupyter	nbviewer	0 – through 1.0.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #1115 issue-tracking
LocalFileHandler.can_show() at 1.0.1 technical-description
Fix path-containment bypass in LocalFileHandler.can_show (PR #1116) patch
https://github.com/jupyter/nbviewer product
VulnCheck Advisory: nbviewer through 1.0.1 Path Traversal via LocalFileHandler third-party-advisory