Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

jupyter-server

17 known vulnerabilities (1 critical, 8 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
2.21.1 (Sep 15, 2026): no advisory affects it
Newest unaffected release
2.21.1 (Sep 15, 2026), the latest release
Advisories
17 · 1 critical, 8 high, 7 medium, 1 low
Weekly downloads
9.2M
Dependents
5,046
Releases
161 since 0.0.1 (Jul 28, 2018)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 17 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

    Affected: from 2.0.0, fixed in 2.6.0.

    Fixed in 2.6.0 (released May 25, 2023, 1245 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • Jupyter Server: 5xx request logging leaks token-bearing Referer header values

    Affected: fixed in 2.21.0.

    Fixed in 2.21.0 (released Aug 27, 2026, 21 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • CVE-2026-44727Critical 9.3

    Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

    Affected: fixed in 2.20.0.

    Fixed in 2.20.0 (released Jun 17, 2026, 5 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • CVE-2026-6657Medium 6.1

    CORS Origin Validation Bypass in jupyter-server

    Affected: from 1.12.0, through 2.17.0.

    Fixed in 2.18.0 (released May 4, 2026, 30 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.21.1, is not affected.

  • CVE-2026-5422Medium 6.8

    Path Traversal in jupyter/jupyter

    Affected: fixed in 2.18.2.

    Fixed in 2.18.2 (released May 6, 2026, 27 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • jupyter-server authentication cookies remain valid after password reset due to static cookie secret

    Affected: fixed in 2.18.0.

    Fixed in 2.18.0 (released May 4, 2026, 1 day before disclosure).

    The latest release, 2.21.1, is not affected.

  • jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat

    Affected: fixed in 2.18.0.

    Fixed in 2.18.0 (released May 4, 2026, 1 day before disclosure).

    The latest release, 2.21.1, is not affected.

  • jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

    Affected: fixed in 2.18.0.

    Fixed in 2.18.0 (released May 4, 2026, 1 day before disclosure).

    The latest release, 2.21.1, is not affected.

  • CVE-2025-61669Medium 6.3

    jupyter_server next parameter open redirect can redirect users to external domains

    Affected: fixed in 2.18.0.

    Fixed in 2.18.0 (released May 4, 2026, 1 day before disclosure).

    The latest release, 2.21.1, is not affected.

  • Jupyter server on Windows discloses Windows user password hash

    Affected: fixed in 2.14.1; fixed in 2.14.1.

    Fixed in 2.14.1 (released May 31, 2024, 6 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • Jupyter Server errors include tracebacks with path information

    Affected: fixed in 2.11.2.

    Fixed in 2.11.2 (released Dec 4, 2023, the day of disclosure).

    The latest release, 2.21.1, is not affected.

  • CVE-2023-39968Medium 4.3

    Open Redirect Vulnerability in jupyter-server

    Affected: fixed in 2.7.2.

    Fixed in 2.7.2 (released Aug 18, 2023, 10 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • CVE-2023-40170Medium 4.6

    cross-site inclusion (XSSI) of files in jupyter-server

    Affected: fixed in 2.7.2.

    Fixed in 2.7.2 (released Aug 18, 2023, 10 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • Known or guessable hidden files may be accessed in Jupyter Server

    Affected: fixed in 1.17.0; fixed in 1.17.1; from 2.0.0a0, fixed in 2.0.0a1.

    Fixed in 1.17.1 (released Jun 7, 2022, 7 days before disclosure) and 2.0.0a1 (released Jun 7, 2022, 7 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • Sensitive Auth & Cookie data stored in Jupyter server logs

    Affected: fixed in 1.15.4.

    Fixed in 1.15.4 (released Mar 15, 2022, 8 days before disclosure).

    The latest release, 2.21.1, is not affected.

Show all 17 advisoriesShow fewer advisories
  • CVE-2020-26275Medium 6.1

    Open redirect vulnerability

    Affected: fixed in 1.1.1; fixed in 1.1.1.

    Fixed in 1.1.1 (released Dec 16, 2020, 5 days before disclosure).

    The latest release, 2.21.1, is not affected.

  • CVE-2020-26232Medium 4.1

    Open redirect in Jupyter Server

    Affected: fixed in 1.0.6.

    Fixed in 1.0.6 (released Nov 18, 2020, 6 days before disclosure).

    The latest release, 2.21.1, is not affected.