jupyter-server@2.11.1

Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames via the NbconvertFileHandler and NbconvertPostHandler classes when rendering user-authored notebook HTML without a proper sandbox directive in the Content-Security-Policy. An attacker can execute arbitrary scripts in the context of the Jupyter origin, exfiltrate authentication tokens, gain access to API endpoints, and potentially achieve remote code execution by crafting a notebook with malicious HTML payloads and convincing an authenticated user to visit a specific URL.

Upgrade jupyter-server to version 2.20.0 or higher.

Affected versions of this package are vulnerable to Permissive Regular Expression in the use of re.match() to verify allow_origin_pat values. This allows an attacker to bypass intended CORS restrictions and gain unauthorized access to sensitive API responses. Code execution is possible by convincing an authenticated user to visiting a malicious origin while the non-default CORS regex allowlist is enabled. re.match() is based on prefix matching, so a malicious domain whose lefthand segments are a trusted domain passes.

Upgrade jupyter-server to version 2.18.0 or higher.

Affected versions of this package are vulnerable to Directory Traversal due to insufficient validation of file paths in _get_os_path() function within jupyter_server/services/contents/fileio.py. An attacker can gain unauthorized read and write access to files outside the intended directory by submitting crafted directory traversal sequences. This may result in exposure of sensitive data, especially in shared hosting environments.

Upgrade jupyter-server to version 2.18.2 or higher.

Affected versions of this package are vulnerable to Regular Expression without Anchors through the allow_origin_pat checks in websocket.py, login.py. An attacker can bypass CORS, WebSocket origin checks, and login redirect validation by supplying an Origin or Referer value that matches the configured pattern only as a prefix, such as a trusted hostname followed by attacker-controlled suffixes. This lets a malicious site make authenticated requests or steer redirects to an attacker-controlled origin, exposing user data and enabling cross-site actions in deployments that rely on allow_origin_pat for origin restrictions.

Workarounds

• Wrap your allow_origin_pat value with ^ and $ so it matches the full origin string instead of only a prefix; this prevents attacker-controlled origins like trusted.example.com.evil.com from passing origin validation.

Upgrade jupyter-server to version 2.18.0 or higher.

Affected versions of this package are vulnerable to Directory Traversal due to the _get_os_path check in fileio.py in the file manager component. An attacker can read, write, and delete files outside the configured root directory by supplying a path whose resolved absolute path shares a prefix with the root, such as a sibling directory name that starts with the root name.

Upgrade jupyter-server to version 2.18.0 or higher.

Affected versions of this package are vulnerable to Open Redirect through the LoginFormHandler in the login handler. An attacker can send a crafted /login request with a protocol-relative redirect target beginning with // to make the application redirect a victim to an external site after login. This can be used for phishing and to send users away from the trusted Jupyter interface to attacker-controlled content.

Upgrade jupyter-server to version 2.18.0 or higher.

Affected versions of this package are vulnerable to Insufficient Session Expiration due to jupyter_cookie_secret never being automatically rotated or cleared. An attacker can keep or reuse authenticated session cookies after a password change by presenting a cookie signed with a secret that does not incorporate the current password. This lets the attacker retain access to the server as the affected user, exposing notebooks, files, and other authenticated server resources.

Workarounds

• Remove ~/.local/share/jupyter/runtime/jupyter_cookie_secret and restart the Jupyter server to invalidate existing authentication cookies, preventing stolen or old cookies from remaining valid after a password change.

Upgrade jupyter-server to version 2.18.0 or higher.

Affected versions of this package are vulnerable to Information Exposure through the NTLMv2 password hash exposure process. An attacker can obtain and potentially crack this hash to gain unauthorized access to the Windows machine hosting the server or to other network-accessible machines or third-party services using the same credentials.

Upgrade jupyter-server to version 2.14.1 or higher.