PyPI/jupyter-server CVE-2026-35397: high 8.8, EPSS 0.67%
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_di
Action: Upgrade jupyter-server to 2.18.0 or later.
pip install jupyter-server==2.18.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.18.0 | - |
Fixed versions
| 2.18.0 |
Sources
- osv: PYSEC-2026-68
- https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3
CVE-2026-35397 · published · modified · JSON