jupyter vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20212
3. 20224
4. 20253
5. 20269

Newest CVEs

• CVE-2026-114140

  nbconvert: File write via path traversal in cell output filenames

  jupyter · nbconvert

  High8.8
• CVE-2026-86258

  nbviewer through 1.0.1 Path Traversal via LocalFileHandler

  jupyter · nbviewer

  High8.2
• CVE-2026-6658

  Cross-site Scripting (XSS) in jupyter/nbconvert

  jupyter · jupyter/jupyter

  Medium5.4
• CVE-2026-6657

  CORS Origin Validation Bypass in jupyter-server

  jupyter · jupyter/jupyter

  Medium6.1
• CVE-2026-5422

  Path Traversal in jupyter/jupyter

  jupyter · jupyter/jupyter

  Medium6.8
• CVE-2026-42557

  jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

  jupyterlab · jupyterlab

  High8.6
• CVE-2026-40171

  Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker

  jupyter · notebook

  High8.4
• CVE-2026-39378

  nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

  jupyter · nbconvert

  Medium6.5
• CVE-2026-39377

  nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

  jupyter · nbconvert

  Medium6.5
• CVE-2025-53000

  nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

  jupyter · nbconvert

  High8.5