jupyter

Products

Exploited and recent CVEs

• CVE-2026-114140 High 8.8 nbconvert: File write via path traversal in cell output filenames 0.5%
• CVE-2026-86258 Medium 5.9 nbviewer through 1.0.1 Path Traversal via LocalFileHandler 0.5%
• CVE-2026-6658 Medium 5.4 Cross-site Scripting (XSS) in jupyter/nbconvert 0.2%
• CVE-2026-6657 Medium 6.1 CORS Origin Validation Bypass in jupyter-server 5.2%
• CVE-2026-5422 Medium 6.8 Path Traversal in jupyter/jupyter 4.9%
• CVE-2026-42557 High 8.8 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content 0.5%
• CVE-2026-40171 High 8.4 Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker 0.5%
• CVE-2026-39378 Medium 6.5 nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding 0.3%
• CVE-2026-39377 Medium 6.5 nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames 0.3%
• CVE-2025-53000 High 8.5 nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows 0.3%
• CVE-2025-30167 High 7.3 Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability 0.2%
• CVE-2025-23205 Medium 6.9 `frame-ancestors: self` grants all users access to formgrader in nbgrader 0.5%
• CVE-2022-39286 High 8.8 Execution with Unnecessary Privileges in JupyterApp 1.4%
• CVE-2021-32862 High 7.5 nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths 1.5%
• CVE-2022-29238 Medium 4.3 Forced Browsing in Jupyter Notebook 1.2%
• CVE-2022-24758 High 7.5 Insertion of Sensitive Information into Log File affects Jupyter Notebook 1.1%
• CVE-2021-41134 High 8.7 Stored XSS in Jupyter nbdime 0.7%
• CVE-2021-32798 Critical 10.0 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook 2.1%
• CVE-2020-26232 Medium 4.1 Open redirect in Jupyter Server 1.0%
• CVE-2020-26215 Medium 4.4 Open redirect in Jupyter Notebook 1.2%