{"action":"Upgrade jupyter-server to 2.18.2 or later.","affected":[{"fixed":"2.18.2","introduced":"0"}],"component":"jupyter-server","cve_ids":["CVE-2026-5422"],"ecosystem":"PyPI","epss":0.04858,"exploited":false,"fixed_versions":["2.18.2"],"ghsa_id":"GHSA-gf7q-q4j7-hp7c","id":"tcs_01M5KH01F15CJ424JD0BNWSV9J","modified_at":"2026-07-13T16:31:58.966038327Z","published_at":"2026-07-13T15:46:13.935289Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2532","https://nvd.nist.gov/vuln/detail/CVE-2026-5422","https://github.com/jupyter-server/jupyter_server","https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f","http://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2","https://pypi.org/project/jupyter-server","https://github.com/advisories/GHSA-gf7q-q4j7-hp7c"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2532","url":"https://osv.dev/vulnerability/PYSEC-2026-2532"}],"summary":"Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()"}