VulertSecurity VulertSecurity

Vulnerability Database · PyPI · jupyter-server · Version

jupyter-server 2.2.1

2.2.1 is affected by 28 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 2.21.1.

Critical 2 High 9 Medium 15 Low 0 Unrated 2

All jupyter-server versions & vulnerabilities → Source repository Search the database for this package →
Released 02 Feb 2023 Licence non-standard Also known from other sources 23 Newer releases 161 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

jupyter-server 2.2.1 vulnerabilities

28 vulnerabilities cover jupyter-server 2.2.1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-44727: jupyter-server Stored XSS via Missing Sandbox CSP 9.3 critical 2.20.0 29 Jun 2026
CVE-2026-44727: Jupyter Server Stored XSS Vulnerability via Nbconvert Handlers 9.3 critical 2.20.0 18 Jun 2026
CVE-2026-114135: Jupyter Server gateway WebSocket handler skips kernel authorization 8.8 high 2.6.0 22 Oct 2026
CVE-2026-35397: Jupyter Server Path Traversal Vulnerability Allows Unauthorized Access to Sibling Directories 8.8 high 2.18.0 05 May 2026
CVE-2026-40110: Jupyter Server CORS Origin Validation Bypass Vulnerability 7.6 high 2.18.0 05 May 2026
CVE-2024-35178: Jupyter Server on Windows NTLMv2 Password Hash Disclosure 7.5 high 2.14.1 06 Jun 2024
CVE-2024-35178: jupyter-server NTLMv2 Password Hash Leak Vulnerability 7.5 high 79fbf801c5908f4d1d9bc90004b74cfaaeeed2df 06 Jun 2024
CVE-2026-40110: Jupyter Server Cross-Origin Request Bypass Vulnerability 7.3 high 2.18.0 05 May 2026
CVE-2026-86049: Jupyter Server 5xx Request Logging Exposes Token in Referer Header 7.1 high 2.21.0 01 Oct 2026
CVE-2026-86049: Jupyter Server Token Leakage in 5xx Request Logging 7.1 high 2.21.0 17 Sep 2026
CVE-2026-35397: Jupyter Server Path Traversal Vulnerability Allows Unauthorized Access to Sibling Directories 7.1 high 2.18.0 05 May 2026
CVE-2026-5422: Jupyter Server Path Traversal Vulnerability Due to Incorrect Directory Check 6.8 medium 2.18.2 13 Jul 2026
CVE-2026-5422: Jupyter Server Path Traversal Vulnerability Due to Incorrect Directory Check 6.8 medium 2.18.2 02 Jun 2026
CVE-2026-40934: jupyter-server Authentication Cookie Vulnerability 6.8 medium 2.18.0 05 May 2026
CVE-2026-40934: Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart 6.8 medium 2.18.0 05 May 2026
CVE-2026-6657: jupyter-server CORS Origin Validation Bypass Vulnerability 6.1 medium No fix published 23 Jul 2026
CVE-2026-6657: jupyter-server CORS Origin Validation Bypass Vulnerability 6.1 medium No fix published 03 Jun 2026
CVE-2025-61669: Jupyter Server Redirect Vulnerability Allows Phishing Attacks 6.1 medium 2.18.0 05 May 2026
CVE-2023-39968: Open Redirect Vulnerability in jupyter-server 6.1 medium 2.7.2 29 Aug 2023
CVE-2023-40170: jupyter-server Improper Cross-Site Credential Checks 6.1 medium 87a4927272819f0b1cae1afa4c8c86ee2da002fd 28 Aug 2023
CVE-2023-39968: Open Redirect Vulnerability in jupyter-server 6.1 medium 290362593b2ffb23c59f8114d76f77875de4b925 28 Aug 2023
CVE-2020-26275: jupyter-server Open Redirect Vulnerability 6.1 medium No fix published 21 Dec 2020
CVE-2025-61669: Jupyter Server Open Redirection Vulnerability in 'next' Parameter 6.0 medium 2.18.0 05 May 2026
CVE-2023-40170: Cross-Site Inclusion Vulnerability in jupyter-server 4.6 medium 2.7.2 29 Aug 2023
CVE-2023-49080: jupyter-server errors include tracebacks with path information 4.3 medium 2.11.2 05 Dec 2023
CVE-2023-49080: jupyter-server Unhandled Error Reveals Traceback Information 4.3 medium 0056c3aa52cbb28b263a7a609ae5f17618b36652 04 Dec 2023
CVE-2020-26275: Open Redirect Vulnerability in Jupyter Server N/A unrated 85e4abccf6ea9321d29153f73b0bd72ccb3a6bca 21 Dec 2020
CVE-2020-26232: Open Redirect Vulnerability in Jupyter Server N/A unrated 3d83e49090289c431da253e2bdb8dc479cbcb157 24 Nov 2020

Looking for another version, or everything Vulert holds for jupyter-server?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About jupyter-server 2.2.1

Is jupyter-server 2.2.1 vulnerable?

Yes. 28 vulnerabilities in the Vulert database cover jupyter-server 2.2.1: 2 critical, 9 high, 15 medium and 0 low, plus 2 not yet rated. The upgrade Vulert recommends is 2.21.1, and each entry above names the fixed version to move to.

Which version of jupyter-server should I use instead of 2.2.1?

2.21.1 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 2.2.1 the latest release of jupyter-server?

No. 2.2.1 was published 02 Feb 2023, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor jupyter-server for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the jupyter-server version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.