CVE-2022-29238: Token bruteforcing in notebook package
Summary
CVE-2022-29238: Token bruteforcing. Affects notebook versions < 6.4.12. Fixed in 6.4.12. How to fix ↓
Also tracked for
- jupyter-notebook · Bitnami
- jupyter-base-notebook · Bitnami
- jupyter-notebook · Debian:11
The same CVE-2022-29238 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The notebook package is an open-source tool used for creating and sharing documents that contain live code, equations, visualizations, and narrative text. It provides an interactive computing environment that supports various programming languages. The package allows users to run code, view results, and create visualizations within a web-based interface. However, a vulnerability has been identified in the notebook package that allows for token bruteforcing.
Vulnerability Detail
The vulnerability in the notebook package allows authenticated requests to the notebook server to access individual hidden files or files in hidden directories, even when the ContentsManager.allow_hidden setting is set to False. While the listing of contents in hidden directories is prevented, this vulnerability allows for unauthorized access to specific hidden files. This could potentially expose sensitive files that are only protected by being hidden. Although fully authenticated requests are required to exploit this vulnerability, it can still lead to unauthorized access to files that should be disallowed. However, it does not result in privilege escalation or increased information access. The impact of this vulnerability is relatively low.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.12
This is the first release that contains the fix.
pip install --upgrade "notebook==6.4.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not possible, users can implement a workaround by following these steps:
- Avoid running the notebook server in a directory that contains hidden files. Instead, use subdirectories to isolate the notebook server.
- Create a custom ContentsManager with additional checks for
self.is_hidden(path)before completing any actions. This will provide an extra layer of protection against unauthorized access to hidden files.
Conclusion
The notebook package has been found to have a vulnerability that allows for token bruteforcing. This vulnerability can lead to unauthorized access to hidden files in the notebook server. However, the impact of this vulnerability is relatively low, and it does not result in privilege escalation or increased information access. Users can fix this vulnerability by upgrading to notebook version 6.4.12 or later. Alternatively, a workaround can be implemented by avoiding directories with hidden files and creating a custom ContentsManager. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
The impact of this vulnerability is relatively low. While it allows for unauthorized access to hidden files in the notebook server, it does not result in privilege escalation or increased information access.
Users of the notebook package who have enabled authentication and have hidden files in their server's root directory are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your notebook package is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will provide real-time alerts for open-source vulnerabilities.
There are currently no known exploits for this vulnerability. However, it is still important to apply the necessary patches or workarounds to prevent unauthorized access to hidden files.
Yes, you can implement the provided workaround by avoiding the use of directories with hidden files and creating a custom ContentsManager with additional checks for hidden files. However, upgrading to the latest version is recommended for a more comprehensive fix.
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
