# jupyter-server (PyPI) vulnerabilities 17 known vulnerabilities (1 critical, 8 high, 7 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.21.1 (Sep 15, 2026): no advisory affects it - Newest unaffected release: 2.21.1 (Sep 15, 2026), the latest release - Weekly downloads: 9.2M - Dependents: 5,046 - Releases: 161 since 0.0.1 (Jul 28, 2018) - Registry: https://pypi.org/project/jupyter-server/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114135: 2.0.0 to 2.5.0 (2.6.0 is outside it) - CVE-2026-86049: 0.0.1 to 2.20.0 (2.21.0 is outside it) - CVE-2026-44727: 0.0.1 to 2.19.0 (2.20.0 is outside it) - CVE-2026-6657: 1.12.0 to 2.17.0 (2.18.0 is outside it) - CVE-2026-5422: 0.0.1 to 2.18.1 (2.18.2 is outside it) - CVE-2026-40934: 0.0.1 to 2.17.0 (2.18.0 is outside it) - CVE-2026-40110: 0.0.1 to 2.17.0 (2.18.0 is outside it) - CVE-2026-35397: 0.0.1 to 2.17.0 (2.18.0 is outside it) - CVE-2025-61669: 0.0.1 to 2.17.0 (2.18.0 is outside it) - CVE-2024-35178: 0.0.1 to 2.14.0 (2.14.1 is outside it) - CVE-2023-49080: 0.0.1 to 2.11.1 (2.11.2 is outside it) - CVE-2023-39968: 0.0.1 to 2.7.1 (2.7.2 is outside it) - CVE-2023-40170: 0.0.1 to 2.7.1 (2.7.2 is outside it) - CVE-2022-29241: 0.0.1 to 1.17.0 (1.17.1 is outside it); 2.0.0a0 (2.0.0a1 is outside it) - CVE-2022-24757: 0.0.1 to 1.15.3 (1.15.4 is outside it) - CVE-2020-26275: 0.0.1 to 1.1.0 (1.1.1 is outside it) - CVE-2020-26232: 0.0.1 to 1.0.5 (1.0.6 is outside it) ## Advisories (17) ### [CVE-2026-114135](https://cve.now/CVE-2026-114135): Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization - Severity: High 8.8 - Published: Oct 21, 2026 - Affected: from 2.0.0, fixed in 2.6.0. - Fixed in 2.6.0 (released May 25, 2023, 1245 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2026-86049](https://cve.now/CVE-2026-86049): Jupyter Server: 5xx request logging leaks token-bearing Referer header values - Severity: High 7.1 - Published: Sep 17, 2026 - Affected: fixed in 2.21.0. - Fixed in 2.21.0 (released Aug 27, 2026, 21 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2026-44727](https://cve.now/CVE-2026-44727): Jupyter Server: Stored XSS in \`NbconvertFileHandler\` / \`NbconvertPostHandler\` via missing \`sandbox\` CSP - Severity: Critical 9.3 - Published: Jun 22, 2026 - Affected: fixed in 2.20.0. - Fixed in 2.20.0 (released Jun 17, 2026, 5 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2026-6657](https://cve.now/CVE-2026-6657): CORS Origin Validation Bypass in jupyter-server - Severity: Medium 6.1 - Published: Jun 3, 2026 - Affected: from 1.12.0, through 2.17.0. - Fixed in 2.18.0 (released May 4, 2026, 30 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.21.1, is not affected. ### [CVE-2026-5422](https://cve.now/CVE-2026-5422): Path Traversal in jupyter/jupyter - Severity: Medium 6.8 - Published: Jun 2, 2026 - Affected: fixed in 2.18.2. - Fixed in 2.18.2 (released May 6, 2026, 27 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2026-40934](https://cve.now/CVE-2026-40934): jupyter-server authentication cookies remain valid after password reset due to static cookie secret - Severity: High 7.6 - Published: May 5, 2026 - Affected: fixed in 2.18.0. - Fixed in 2.18.0 (released May 4, 2026, 1 day before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2026-40110](https://cve.now/CVE-2026-40110): jupyter-server CORS origin validation bypass via unanchored regex in allow\_origin\_pat - Severity: High 7.6 - Published: May 5, 2026 - Affected: fixed in 2.18.0. - Fixed in 2.18.0 (released May 4, 2026, 1 day before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2026-35397](https://cve.now/CVE-2026-35397): jupyter-server path traversal allows access to sibling directories sharing root\_dir name prefix - Severity: High 7.6 - Published: May 5, 2026 - Affected: fixed in 2.18.0. - Fixed in 2.18.0 (released May 4, 2026, 1 day before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2025-61669](https://cve.now/CVE-2025-61669): jupyter\_server next parameter open redirect can redirect users to external domains - Severity: Medium 6.3 - Published: May 5, 2026 - Affected: fixed in 2.18.0. - Fixed in 2.18.0 (released May 4, 2026, 1 day before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2024-35178](https://cve.now/CVE-2024-35178): Jupyter server on Windows discloses Windows user password hash - Severity: High 7.5 - Published: Jun 6, 2024 - Affected: fixed in 2.14.1; fixed in 2.14.1. - Fixed in 2.14.1 (released May 31, 2024, 6 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2023-49080](https://cve.now/CVE-2023-49080): Jupyter Server errors include tracebacks with path information - Severity: Low 3.5 - Published: Dec 4, 2023 - Affected: fixed in 2.11.2. - Fixed in 2.11.2 (released Dec 4, 2023, the day of disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2023-39968](https://cve.now/CVE-2023-39968): Open Redirect Vulnerability in jupyter-server - Severity: Medium 4.3 - Published: Aug 28, 2023 - Affected: fixed in 2.7.2. - Fixed in 2.7.2 (released Aug 18, 2023, 10 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2023-40170](https://cve.now/CVE-2023-40170): cross-site inclusion (XSSI) of files in jupyter-server - Severity: Medium 4.6 - Published: Aug 28, 2023 - Affected: fixed in 2.7.2. - Fixed in 2.7.2 (released Aug 18, 2023, 10 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2022-29241](https://cve.now/CVE-2022-29241): Known or guessable hidden files may be accessed in Jupyter Server - Severity: High 7.1 - Published: Jun 14, 2022 - Affected: fixed in 1.17.0; fixed in 1.17.1; from 2.0.0a0, fixed in 2.0.0a1. - Fixed in 1.17.1 (released Jun 7, 2022, 7 days before disclosure) and 2.0.0a1 (released Jun 7, 2022, 7 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2022-24757](https://cve.now/CVE-2022-24757): Sensitive Auth & Cookie data stored in Jupyter server logs - Severity: High 7.5 - Published: Mar 23, 2022 - Affected: fixed in 1.15.4. - Fixed in 1.15.4 (released Mar 15, 2022, 8 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2020-26275](https://cve.now/CVE-2020-26275): Open redirect vulnerability - Severity: Medium 6.1 - Published: Dec 21, 2020 - Affected: fixed in 1.1.1; fixed in 1.1.1. - Fixed in 1.1.1 (released Dec 16, 2020, 5 days before disclosure). - The latest release, 2.21.1, is not affected. ### [CVE-2020-26232](https://cve.now/CVE-2020-26232): Open redirect in Jupyter Server - Severity: Medium 4.1 - Published: Nov 24, 2020 - Affected: fixed in 1.0.6. - Fixed in 1.0.6 (released Nov 18, 2020, 6 days before disclosure). - The latest release, 2.21.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/jupyter-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.