CVE-2020-26215: Open redirect in Jupyter Notebook
Summary
CVE-2020-26215: Open redirect in Jupyter Notebook. Affects notebook versions < 6.1.5. Fixed in 6.1.5. How to fix ↓
Also tracked for
- jupyter-notebook · Bitnami
- jupyter-base-notebook · Bitnami
- jupyter-notebook · Debian:11
The same CVE-2020-26215 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Notebook is an open-source web application that allows users to create and share documents containing live code, equations, visualizations, and narrative text. It is widely used for data science and machine learning tasks. However, a vulnerability has been discovered in Jupyter Notebook that allows for open redirects. This means that a maliciously crafted link to a notebook server could redirect the user's browser to a different website.
Vulnerability Detail
The open redirect vulnerability in Jupyter Notebook poses a risk to users who click on maliciously crafted links. While all notebook servers are technically affected, the impact is limited to known notebook server hosts. Attackers can create links that appear safe but ultimately redirect users to spoofed servers on the public internet. This can lead to various attacks, such as phishing attempts or the execution of malicious code on the user's system.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.1.5
This is the first release that contains the fix.
pip install --upgrade "notebook==6.1.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The open redirect vulnerability in Jupyter Notebook can be mitigated by upgrading to version 6.1.5 or later. It is important to promptly apply the patch to ensure the security of your notebook server. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
An open redirect vulnerability occurs when a web application allows an attacker to redirect users to an arbitrary website. This can be exploited to trick users into visiting malicious websites or phishing pages.
All users of Jupyter Notebook are potentially affected by this vulnerability. However, the impact is limited to known notebook server hosts.
You can use the Vulert Playground at Vulert Scanner to check if your Jupyter Notebook installation is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will provide real-time alerts for open-source vulnerabilities.
There are currently no known exploits of this vulnerability. However, it is important to patch your Jupyter Notebook installation to prevent any potential attacks.
If you have any questions, comments, or vulnerabilities to report, please email the Jupyter security team at security@ipython.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
