Path Traversal Vulnerability in nbviewer by Jupyter

CVE-2026-86258

What is CVE-2026-86258?

The nbviewer application, up to and including version 1.0.1, is susceptible to a path traversal vulnerability in the LocalFileHandler.can_show() function. This vulnerability arises due to the use of string-prefix comparison rather than robust path validation. As a result, an attacker can exploit this flaw to gain unauthorized access to files located in sibling directories outside the designated root directory. By sending crafted path requests, malicious users can disclose sensitive information, such as notebooks and credential files that should remain protected.

References