chore(deps): update dependency jupyter-server to v2.20.0 [security] - #7

Open

renovate[bot] wants to merge 1 commit into

mainfrom

renovate/pypi-jupyter-server-vulnerability

renovate Bot commented Apr 27, 2025 •

edited

Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
jupyter-server	`==2.9.1` → `==2.20.0`

jupyter-server errors include tracebacks with path information

CVE-2023-49080 / GHSA-h56g-gq9v-vc8r

More information

Details

Impact

Unhandled errors in API requests include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment.

Patches

jupyter-server PATCHED_VERSION no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty.

Workarounds

None

Severity

CVSS Score: 4.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Jupyter Server has an open redirection vulnerability in `next` query parameter

CVE-2025-61669 / GHSA-qh7q-6qm3-653w

More information

Details

Summary

The ?next=... URL query parameter has an open redirection vulnerability. In jupyter_server<=2.17.0, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.

Details

The vulnerability is caused by insufficient validation in the LoginFormHandler._redirect_safe() method.

Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76

This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.

PoC

Navigate to http://localhost:8888/login?next=///google.com
Observe that the user is redirected to google.com despite it being an external domain.

The external domain passed in the ?next parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as prod.company.com may be redirected to a look-alike URL such as prod.company.dev.

Impact

This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.

Patches

Jupyter Server 2.18+

Workaround

None.

Severity

CVSS Score: 6.0 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories

CVE-2026-35397 / GHSA-5789-5fc7-67v3

More information

Details

Summary

Jupyter Server <=2.17.0 can access directories sibling to the root directory, if it starts with the root dir's name.

PoC

Minimal:

.
├── test/              <- root directory.
│   └── test.txt
└── testtest/
    └── secret.txt     <- file to exfiltrate that we should not be able to access via API

HOST="http://localhost:8888"
TOKEN=""
SIBLING="testtest"
TARGET="secret.txt"

curl -s -X POST \
  "$HOST/api/contents/%2e%2e/$SIBLING/$TARGET/checkpoints" \
  -H "Authorization: token $TOKEN"

Full PoC by @stef41: https://gist.github.com/Yann-P/66d4982a965dee8fcb8dd89db29e7006

Impact

It is possible for an authenticated user to access content outside the server's root_dir in siblings directories sharing the same prefix as the root_dir. The attacker can escalate access, reading, writing, and deleting from sibling directories.

This can have a tangible impact for deployments using predictable naming scheme with multi-tenant server, for example user1, user2, user3, ..., user10 etc, as user1 could access and modify files of all user10 - user19 and higher.

In a hypothetical system where users can choose a name of their folder, an attacker could choose a single-letter username to gain access to a significant number of sibling directories.

Workarounds

Use folder names that do not overlap.

Acknowledgments

Thank you to @stef41 for providing a useful PoC.

Severity

CVSS Score: 7.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

CVE-2026-40110 / GHSA-24qx-w28j-9m6p

More information

Details

Jupyter Server uses re.match() to validate the Origin header against the allow_origin_pat configuration.

Since re.match() only anchors at the start of the string, an attacker who controls a domain like http://trusted.example.com.evil.com/ passes validation against a pattern intended to match only trusted.example.com.

Impact

<=2.17.0

Patches

057869a327c46730afede3eab0ca2d2e3e74acea, 49b34392feaa97735b3b777e3baf8f22f2a14ed8

Workarounds

Wrap your allow_origin_pat value with ^ and $

References

https://github.com/jupyter-server/jupyter_server/pull/603
https://docs.python.org/3/library/re.html#re.fullmatch
https://docs.python.org/3/library/re.html#re.match

Severity

CVSS Score: 7.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart

CVE-2026-40934 / GHSA-5mrq-x3x5-8v8f

More information

Details

Summary

A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes.

The cookie secret used to sign authentication cookies is stored in a permanent file (~/.local/share/jupyter/runtime/jupyter_cookie_secret) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets.

PoC

Start a Jupyter server with password authentication: jupyter server password, jupyter server
Log in with the password and capture the authentication cookie (e.g., just login with a browser).
Change the password to revoke access: jupyter server password
Restart the server
Use the old stolen cookie => remains valid and provides full authenticated access.

Impact

All jupyter-server deployments using password authentication where security incidents may occur
Multi-user systems where one user's compromised session should be revocable by administrators
Shared or public-facing Jupyter servers where credential rotation is a security requirement
Any deployment where password changes are expected to revoke existing sessions

Patches

Jupyter Server 2.18+

Workaround

rm ~/.local/share/jupyter/runtime/jupyter_cookie_secret

##### Then restart the server

Severity

CVSS Score: 7.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

CVE-2026-44727 / GHSA-fcw5-x6j4-ccmp

More information

Details

The nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy.

Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE.

Impact

An authenticated victim who navigates to /nbconvert/html/<path> containing attacker-authored output can have their token exfiltrated to another domain because it is executed in the Jupyter origin.

Patches

Fixed in v2.20.0, commit 6cbee8d

Workarounds

For deployments where editing the installed jupyter_server is impractical (containerized builds, read-only images), adding this to jupyter_server_config.py has the same effect as the patch above without touching source files:

import jupyter_server.nbconvert.handlers as _nb

def _csp(self):
    return super(type(self), self).content_security_policy + "; sandbox allow-scripts"

_nb.NbconvertFileHandler.content_security_policy = property(_csp)
_nb.NbconvertPostHandler.content_security_policy = property(_csp)

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

jupyter-server/jupyter_server (jupyter-server)

`v2.20.0`

(Full Changelog)

Enhancements made

Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@Yann-P, @minrk)
Add a toggle to enable curve encryption for all kernels that support it #1638 (@krassowski, @Carreau, @ianthomas23, @minrk)

Bugs fixed

Grab the port from bind_sockets in case its different #1651 (@choldgraf, @krassowski)

Maintenance and upkeep improvements

Fix test_authorizer having a spurious comma in params #1664 (@krassowski)
Add a reminder to merge GHSA before release #1659 (@Yann-P, @Carreau)
Exclude problematic pywinpty 3.0.4 version #1658 (@krassowski)
ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@Carreau, @Copilot)

Documentation improvements

Align docs for curve encryption with latest JEP version #1660 (@krassowski, @Carreau)
Remove PGP key from docs #1653 (@Yann-P, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @choldgraf (activity) | @Copilot (activity) | @ianthomas23 (activity) | @krassowski (activity) | @minrk (activity) | @Yann-P (activity)

`v2.19.0`

(Full Changelog)

Enhancements made

Return unresolved stanza when kernel scope is unavailable for resolvePath (instead of failing with 404) #1641 (@MUFFANUJ, @Carreau, @krassowski)

Bugs fixed

Recreate notary store on failure to prevent save deadlock and data loss #1640 (@krassowski, @Carreau)

Maintenance and upkeep improvements

Restore the test skip marks with updated compatibility reason #1646 (@krassowski, @Carreau)
Drop Python 3.9 #1644 (@krassowski, @Zsailer)
Bump minimatch from 3.1.2 to 3.1.5 #1606 (@Carreau, @minrk)

Other merged PRs

Update pytest requirement from <9,>=7.0 to >=7.0,<10 #1647 (@Carreau)
fix: use percent-placeholder args in HTTPError to prevent Tornado from doubling percent signs in gateway URLs #1642 (@terminalchai, @Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @ianthomas23 (activity) | @krassowski (activity) | @minrk (activity) | @MUFFANUJ (activity) | @terminalchai (activity) | @Zsailer (activity)

`v2.18.2`

(Full Changelog)

Bugs fixed

Fix saving user avatar URL #1637 (@brichet, @krassowski)
Fix path resolution if root_dir is a filesystem root #1636 (@Yann-P, @krassowski)

Maintenance and upkeep improvements

Add Zulip notification when a release is complete #1634 (@Yann-P, @Carreau)
chore: update pre-commit hooks #1633 (@Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@brichet (activity) | @Carreau (activity) | @krassowski (activity) | @Yann-P (activity)

`v2.18.1`

(Full Changelog)

Bugs fixed

Prevent reconnect stalls from orphaned kernel_info requests #1632 (@krassowski, @Copilot, @jtpio, @tonyx93)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@Copilot (activity) | @jtpio (activity) | @krassowski (activity) | @tonyx93 (activity)

`v2.18.0`

(Full Changelog)

API and Breaking Changes

Add query param to sanitize HTML in GET /nbconvert/html #1618 (@Yann-P, @Carreau)

Enhancements made

Update handlers.py to fix ioloop blockers(sync file operations) #1617 (@zolyfarkas-fb, @Carreau)
Avoid redundant call to _get_os_path in _dir_model #1547 (@joeyutong, @vidartf)
Allow specifying extra params to scrub from logs #1538 (@jtpio, @Zsailer, @vidartf)
Add a logger to the ExtensionPoint API #1523 (@Zsailer, @vidartf)
Allow user to update identity values #1518 (@brichet, @minrk)
If ServerApp.ip is ipv6 use [::1] as local_url #1495 (@manics, @afshin)
Better error message when starting kernel for session. #1478 (@Carreau, @davidbrochart, @krassowski, @minrk)
Add a traitlet to disable recording HTTP request metrics #1472 (@yuvipanda, @Zsailer)
prometheus: Expose 3 activity metrics #1471 (@yuvipanda, @Zsailer)
Add prometheus info metrics listing server extensions + versions #1470 (@yuvipanda, @Zsailer)
Add prometheus metric with version information #1467 (@yuvipanda, @Zsailer)
Don't hide .so,.dylib files by default #1457 (@nokados, @krassowski, @minrk, @vidartf)
Better hash format error message #1442 (@fcollonval, @Zsailer)
Removing excessive logging from reading local files #1420 (@lresende, @kevin-bates)
Add async start hook to ExtensionApp API #1417 (@Zsailer, @Darshan808, @bollwyvl, @fcollonval, @krassowski)
Do not include token in dashboard link, when available #1406 (@minrk, @blink1073)
Add an option to have authentication enabled for all endpoints by default #1392 (@krassowski, @Wh1isper, @blink1073, @bollwyvl, @minrk, @yuvipanda)
websockets: add configurations for ping interval and timeout #1391 (@oliver-sanders, @blink1073)
log extension import time at debug level unless it's actually slow #1375 (@minrk, @Zsailer, @yuvipanda)
Add support for async Authorizers (part 2) #1374 (@Zsailer, @blink1073)
Support async Authorizers #1373 (@Zsailer, @blink1073)
Support get file(notebook) md5 #1363 (@Wh1isper, @blink1073, @bollwyvl, @krassowski)
Update kernel env to reflect changes in session #1354 (@blink1073, @Carreau, @krassowski)
Add resolvePath API for resolving kernel-relative paths #1331 (@krassowski, @Carreau, @blink1073)

Bugs fixed

Move check origin into a util function and add it to websocket #1630 (@Carreau, @Yann-P)
Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart #1628 (@Carreau, @claude, @krassowski)
Try to fix flaky test "test_restart_kernel" #1625 (@Carreau)
Fix potential unraisable pytest error #1624 (@Carreau)
fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs #1620 (@terminalchai, @krassowski, @ptch314)
Fix three file descriptor leaks in kernel connection lifecycle (#1506) #1619 (@tonyx93, @Carreau)
Use web.HTTPError for kernel restart failures #1616 (@YDawn, @Carreau)
Handle EADDRINUSE and EACCES in _bind_http_server_tcp #1613 (@YDawn, @Zsailer, @minrk)
Use st_birthtime for file created timestamp on macOS/BSD #1594 (@ktaletsk, @krassowski, @minrk)
Fix double write when refusing hidden files in contents handler #1585 (@Krish-876, @minrk)
Close all sockets in _find_http_port explicitly #1584 (@MaryushSoroka, @minrk)
Fix writing on remote file systems with attribute cache #1574 (@krassowski, @Zsailer)
Add IdentityProvider.cookie_secret_hook #1569 (@emin63, @minrk)
fix context pollution #1561 (@dualc, @Zsailer)
Fix gateway cookie handling #1558 (@kevin-bates, @RRosio, @lresende, @minrk)
Fix FileNotFoundError handling in rename_file methods #1548 (@aws-jasakshi, @Zsailer, @dlqqq)
Use stdlib override when possible #1532 (@edrogers, @bollwyvl, @krassowski, @vidartf)
Update meetings notes link and zoom link #1517 (@krassowski, @afshin, @minrk)
Fallback to direct write for readonly dirs and use temp path for checkpoints #1516 (@Darshan808, @afshin, @krassowski)
Check file permissions before making tmp file #1513 (@RRosio, @afshin)
Validate extension name before toggling through CLI #1509 (@Darshan808, @Zsailer, @afshin, @krassowski)
Fix for #1479 : Incorrect usage of i18n format #1500 (@kjayan, @andrii-i, @astitv-sh, @vidartf)
Fix handling of missing parent header in record activity #1498 (@davidbrochart, @minrk)
display_url: Don't duplicate public_url and local_url if they are the same #1494 (@manics, @Zsailer, @krassowski)
fix connection exception cause high cpu load #1484 (@dualc, @lresende, @minrk)
CORS is not checked when browsing files. check origin now #1459 #1465 (@gogasca, @Zsailer, @vidartf)
Return HTTP 400 when attempting to post an event with an unregistered schema #1463 (@afshin, @Zsailer)
write server extension list to stdout #1451 (@minrk)
don't let ExtensionApp jpserver_extensions be overridden by config #1447 (@minrk, @Zsailer)
Pass session_id during Websocket connect #1440 (@gogasca, @Zsailer, @blink1073, @krassowski)
Do not log environment variables passed to kernels #1437 (@krassowski, @blink1073, @minrk)
extensions: render default templates with default static_url #1435 (@minrk, @Zsailer)
Improve the busy/idle execution state tracking for kernels. #1429 (@ojarjur, @Zsailer, @krassowski, @vidartf)
Ignore zero-length page_config.json, restore previous behavior of crashing for invalid JSON #1405 (@holzman, @blink1073)
Don't crash on invalid JSON in page_config (#1403) #1404 (@holzman, @Zsailer)
Fix color in windows log console with colorama #1397 (@hansepac, @blink1073, @jasongrout)
Fix log arguments for gateway client error #1385 (@minrk, @blink1073)
Import User unconditionally #1384 (@yuvipanda, @blink1073)
Fix a typo in error message #1381 (@krassowski, @kevin-bates)
avoid unhandled error on some invalid paths #1369 (@minrk, @blink1073)
Change md5 to hash and hash_algorithm, fix incompatibility #1367 (@Wh1isper, @blink1073, @davidbrochart, @fcollonval)
ContentsHandler return 404 rather than raise exc #1357 (@bloomsa, @Wh1isper, @blink1073)
Force legacy ws subprotocol when using gateway #1311 (@epignot, @Zsailer)

Maintenance and upkeep improvements

Start to test on Python 3.13 and 3.14 #1623 (@Carreau)
Fix package spec for jupytext #1614 (@krassowski, @Zsailer)
chore: update pre-commit hooks #1607 (@minrk)
try to fix ci on windows #1600 (@minrk, @krassowski)
run prerelease tests on 3.14 #1599 (@minrk)
Pin sphinx to an older version (<9) to fix docs #1597 (@krassowski, @minrk)
Restore running all tests for Windows in CI workflow #1581 (@krassowski, @Zsailer)
Fix flaky test_execution_state test #1579 (@krassowski, @Zsailer)
Fix failing link check due to a blog post referred in docs changing URL format #1577 (@krassowski, @Zsailer)
Fix lint on CI, pin ruff to the same version in hatch fmt and pre-commit #1576 (@krassowski, @Zsailer)
Bump actions/checkout from 5 to 6 in the actions group #1572 (@minrk)
don't link check npm #1568 (@minrk, @Zsailer)
Bump the actions group across 1 directory with 2 updates #1551 (@Zsailer)
Bump brace-expansion from 1.1.11 to 1.1.12 #1546 (@minrk)
Replace @flaky.flaky decorate with pytest marker #1544 (@mgorny, @minrk)
Fix the failing "Test Lint" check on CI #1540 (@jtpio, @Zsailer, @krassowski)
tests: install test-functional requirements for Jupytext downstream tests #1510 (@MaicoTimmerman, @Zsailer, @krassowski)
Donation link NF -> LF #1485 (@Carreau, @minrk)
Handle newer jupyter_events wants string version, drop 3.8 [#1481](https://redirect.gith

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/pypi-jupyter-server-vulnerability branch from 9891ed0 to 57c8e33 Compare

May 7, 2026 16:45

renovate Bot changed the title ~~chore(deps): update dependency jupyter-server to v2.11.2 [security]~~ chore(deps): update dependency jupyter-server to v2.18.0 [security]


          chore(deps): update dependency jupyter-server to v2.20.0 [security]

8c72b22

renovate Bot force-pushed the renovate/pypi-jupyter-server-vulnerability branch from 57c8e33 to 8c72b22 Compare

June 20, 2026 19:46

renovate Bot changed the title ~~chore(deps): update dependency jupyter-server to v2.18.0 [security]~~ chore(deps): update dependency jupyter-server to v2.20.0 [security]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet