Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

jupyter.org Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
14
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • Jupyter ecosystem

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

14 targets. 5 excluded.

  • https://jupyter.org

    Web

  • BinderHub and repo2docker, which build and run an image from a repository a stranger supplied

    Products and areas

  • jupyter-server end to end: the REST API, the token and cookie authentication layer, the identity model, the XSRF protections and the handlers behind them

    Products and areas

  • JupyterHub in full: the hub API, the proxy, the OAuth flow between hub and single-user servers, and the shipped authenticators and spawners

    Products and areas

  • JupyterLab in full: the extension system, the plugin loading path, the settings and workspace stores, and every renderer that displays output a kernel produced

    Products and areas

  • nbconvert in full: every exporter, the template engine, the preprocessors, and the handling of notebook content while converting it

    Products and areas

  • nbformat, covering notebook reading, validation, signing and the trust database that decides whether stored output is rendered

    Products and areas

  • Output rendering and mimetype handling wherever it happens, including HTML, JavaScript, SVG, LaTeX and Markdown output, and the sanitiser that is supposed to be in front of it

    Products and areas

  • The classic notebook application and the nbclassic compatibility layer

    Products and areas

  • The contents manager and the file API, covering every path where a request names a file on the server's disk

    Products and areas

  • The kernel protocol and the kernel provisioner path, including message signing, connection files and the ZMQ channels between a front end and a kernel

    Products and areas

  • The published policy asks for any vulnerability in a Jupyter project through a GitHub Security Advisory in the relevant repository or by email, and draws no boundary narrower than the ecosystem itself. Everything below sits inside that

    Products and areas

  • The terminal and console surfaces, and the file upload and download paths in every one of the above

    Products and areas

  • Voila, which serves a notebook as an application to users who never see the notebook itself

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A server an operator deliberately started with authentication disabled or bound to a public interface without a token

  • A user executing code in their own kernel, which is the entire purpose of a notebook server. The finding has to cross a user, tenant or privilege boundary

  • SageMaker Studio, Vertex AI Workbench, Databricks notebooks, Google Colab and other vendor products built on the Jupyter stack: those vendors' own code and configuration belong to them

  • Third-party extensions, kernels, authenticators and spawners that the project does not maintain

  • Upstream Tornado, IPython or Python dependency bugs, unless a Jupyter project's own use of them is what makes the bug reachable

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-44182 Critical

    Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g.

  • CVE-2026-44181 Critical

    Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables (KERNEL_XXX) used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection (SSTI). By including Jinja2 template expressions it is possible to

  • CVE-2026-44180 Critical

    Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 (root), and this restriction can be bypassed using a specially crafted KERNEL_UID or KERNEL_GID value. This input

  • CVE-2026-54527 Critical

    JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.

  • CVE-2026-54528 High

    JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

  • CVE-2026-44727 Critical

    Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with

  • CVE-2026-6657 High

    A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This allows attacker-controlled domains such as `trusted.example.com.evil.com` to pass validation again

  • CVE-2026-5422 High

    A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the

About this page

This page gathers every public program listed under jupyter.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.