CVE-2022-29238: Jupyter Notebook - Unauthorized Access to Hidden Files
Summary
CVE-2022-29238: Jupyter Notebook is a web-based notebook environment for interactive computing. Affects notebook versions < 6.4.12. Fixed in 6.4.12. How to fix ↓
Also tracked for
- jupyter-notebook · Bitnami
- jupyter-base-notebook · Bitnami
- jupyter-notebook · Debian:11
The same CVE-2022-29238 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Notebook is a web-based notebook environment for interactive computing. It allows users to create and share documents that contain live code, equations, visualizations, and narrative text. The notebook server provides a web interface for creating, editing, and running notebooks. It is widely used in data science and scientific computing communities.
Vulnerability Detail
Prior to version 6.4.12, Jupyter Notebook had a vulnerability that allowed authenticated users to access hidden files and files in hidden directories. Although the ContentsManager.allow_hidden setting prevented listing the contents of hidden directories, it did not prevent individual hidden files or files within hidden directories from being accessed. This could potentially lead to unauthorized access to sensitive files that should have been disallowed. While this vulnerability requires fully authenticated requests, it could still pose a risk if the server's root directory contains sensitive files that are only protected by being hidden. If the names of these files are guessable, authenticated requests could access them. However, this vulnerability does not result in privilege escalation or increased information access, as the authenticated requests already have full access to the server and its files.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.12
This is the first release that contains the fix.
pip install --upgrade "notebook==6.4.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this vulnerability.
Conclusion
Jupyter Notebook prior to version 6.4.12 had a vulnerability that allowed authenticated users to access hidden files and files in hidden directories. This could potentially lead to unauthorized access to sensitive files. However, the impact of this vulnerability is relatively low as it requires fully authenticated requests. Upgrading to Jupyter Notebook version 6.4.12 or later is recommended to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
Jupyter Notebook is a web-based notebook environment for interactive computing. It allows users to create and share documents that contain live code, equations, visualizations, and narrative text.
The impact of this vulnerability is relatively low as it requires fully authenticated requests. However, if the server's root directory contains sensitive files that are only protected by being hidden, authenticated users could potentially access them if the file names are guessable.
No, this vulnerability does not result in privilege escalation. Authenticated requests already have full access to the server and its files.
No, there are currently no known workarounds for this vulnerability.
To fix this vulnerability, it is recommended to upgrade Jupyter Notebook to version 6.4.12 or later. This version contains a patch that addresses the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
