Vendor
Jupyter
72 known vulnerabilities in products by Jupyter, 0 of them actively exploited (CISA KEV).
Key figures
72
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
15
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-42266 | Jupyterlab: Argument Injection | 8.8 | |
| High | CVE-2026-5422 | Path Traversal in jupyter/jupyter | 6.8 | |
| High | CVE-2026-6657 | CORS Origin Validation Bypass in jupyter-server | 6.1 | |
| Critical | CVE-2021-32798 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook | 10.0 | |
| Critical | CVE-2021-39159 | Remote code execution in Binderhub | 9.6 | |
| Critical | CVE-2021-32797 | JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> | 7.4 | |
| Critical | CVE-2026-44181 | Jupyter-server Enterprise Gateway: Improper Neutralization of Special Elements Used in a Template Engine | 10.0 | |
| Critical | CVE-2026-44180 | Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed | 9.8 | |
| High | CVE-2018-7206 | Jupyter Oauthenticator: security vulnerability | 8.8 | |
| Critical | CVE-2026-44182 | Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering | 10.0 | |
| Critical | CVE-2024-39700 | Jupyterlab Extension-template: Code Injection | 10.0 | |
| High | CVE-2022-39286 | Execution with Unnecessary Privileges in JupyterApp | 8.8 | |
| Critical | CVE-2026-54527 | JupyterLab Git: Stored XSS leading to RCE | 9.0 | |
| Critical | CVE-2024-28179 | Jupyter Server Proxy's Websocket Proxying does not require authentication | 9.1 | |
| High | CVE-2026-86258 | nbviewer through 1.0.1 Path Traversal via LocalFileHandler | 5.9 | |
| High | CVE-2021-32862 | nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths | 7.5 | |
| High | CVE-2026-114140 | nbconvert: File write via path traversal in cell output filenames | — | |
| High | CVE-2026-35397 | jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix | 8.8 | |
| Medium | CVE-2019-10255 | Jupyter JupyterHub: Open Redirect | 6.1 | |
| Critical | CVE-2026-44727 | Jupyter Server: Cross-site Scripting | 5.4 | |
| High | CVE-2022-24757 | Sensitive Auth & Cookie data stored in Jupyter server logs | 7.5 | |
| Medium | CVE-2018-19351 | Jupyter Notebook: Cross-Site Scripting (XSS) | 6.1 | |
| Critical | CVE-2026-42557 | Jupyterlab: Cross-site Scripting | 9.6 | |
| High | CVE-2022-24758 | Insertion of Sensitive Information into Log File affects Jupyter Notebook | 7.5 | |
| High | CVE-2026-40171 | Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker | — |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,
Products
| Jupyter Notebook | 18 | 0 |
| Jupyter Server | 15 | 0 |
| Jupyterlab | 8 | 0 |
| Jupyter JupyterHub | 7 | 0 |
| Nbconvert | 5 | 0 |
| Oauthenticator | 5 | 0 |
| Jupyter Enterprise Gateway | 3 | 0 |
| Jupyter/jupyter | 3 | 0 |
| Jupyter Server Proxy | 3 | 0 |