CVE-2020-26215: Open Redirect Vulnerability in Jupyter Notebook
Summary
CVE-2020-26215: Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. Affects notebook across 2 version ranges.
< 3cec4bbe21756de9f0c4bccf18cf61d840314d74
< 6.1.5
Fixed in 3cec4bbe21756de9f0c4bccf18cf61d840314d74. How to fix ↓
Also tracked for
- jupyter-notebook · Bitnami
- jupyter-base-notebook · Bitnami
- jupyter-notebook · Debian:11
The same CVE-2020-26215 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Notebook is an open-source web application that allows users to create and share documents containing live code, equations, visualizations, and narrative text. It is widely used for data cleaning and transformation, numerical simulation, statistical modeling, data visualization, machine learning, and more. Jupyter Notebook is written in Python and provides an interactive computing environment that supports various programming languages.
Vulnerability Detail
Jupyter Notebook before version 6.1.5 is vulnerable to an open redirect attack. This vulnerability allows an attacker to craft a malicious link that can redirect the user's browser to a different website. While all notebook servers are technically affected, the attacker can only reasonably create these malicious links for known notebook server hosts. This means that a link to a notebook server may appear safe, but it can ultimately redirect the user to a spoofed server on the public internet. The issue has been patched in version 6.1.5.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3cec4bbe21756de9f0c4bccf18cf61d840314d74
This is the first release that contains the fix.
pip install --upgrade "notebook==3cec4bbe21756de9f0c4bccf18cf61d840314d74"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched version as soon as possible.
Conclusion
The open redirect vulnerability in Jupyter Notebook before version 6.1.5 can allow attackers to redirect users to spoofed websites. To protect against this vulnerability, it is crucial to upgrade to Jupyter Notebook version 6.1.5 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for notebook →
FAQ
An open redirect vulnerability occurs when a web application allows an attacker to craft a URL that redirects the user to a different website. This can be exploited to trick users into visiting malicious websites or phishing pages.
You can use the Vulert Playground at Vulert Scanner to check if your Jupyter Notebook installation is affected by this vulnerability. Simply enter your Pipfile.lock and it will alert you in real-time if any open-source vulnerabilities are detected.
Technically, all notebook servers are affected. However, the attacker can only create malicious links for known notebook server hosts. This means that if you are using a notebook server with a custom host or IP address, the risk of exploitation is significantly lower.
No, the only way to fully mitigate the risk is to upgrade to Jupyter Notebook version 6.1.5 or later. Upgrading ensures that the open redirect vulnerability is patched and no longer exploitable.
There is no evidence of this vulnerability being actively exploited in the wild. However, it is always recommended to stay updated with the latest security patches to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
