- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 5 excluded.
Web 1
- https://jupyter.org
Products and areas 13
- BinderHub and repo2docker, which build and run an image from a repository a stranger supplied
- JupyterHub in full: the hub API, the proxy, the OAuth flow between hub and single-user servers, and the shipped authenticators and spawners
- JupyterLab in full: the extension system, the plugin loading path, the settings and workspace stores, and every renderer that displays output a kernel produced
- jupyter-server end to end: the REST API, the token and cookie authentication layer, the identity model, the XSRF protections and the handlers behind them
- nbconvert in full: every exporter, the template engine, the preprocessors, and the handling of notebook content while converting it
- nbformat, covering notebook reading, validation, signing and the trust database that decides whether stored output is rendered
- Output rendering and mimetype handling wherever it happens, including HTML, JavaScript, SVG, LaTeX and Markdown output, and the sanitiser that is supposed to be in front of it
- The classic notebook application and the nbclassic compatibility layer
- The contents manager and the file API, covering every path where a request names a file on the server's disk
- The kernel protocol and the kernel provisioner path, including message signing, connection files and the ZMQ channels between a front end and a kernel
- The published policy asks for any vulnerability in a Jupyter project through a GitHub Security Advisory in the relevant repository or by email, and draws no boundary narrower than the ecosystem itself. Everything below sits inside that
- The terminal and console surfaces, and the file upload and download paths in every one of the above
- Voila, which serves a notebook as an application to users who never see the notebook itself
Out of scope (5)
- A server an operator deliberately started with authentication disabled or bound to a public interface without a token
- A user executing code in their own kernel, which is the entire purpose of a notebook server. The finding has to cross a user, tenant or privilege boundary
- SageMaker Studio, Vertex AI Workbench, Databricks notebooks, Google Colab and other vendor products built on the Jupyter stack: those vendors' own code and configuration belong to them
- Third-party extensions, kernels, authenticators and spawners that the project does not maintain
- Upstream Tornado, IPython or Python dependency bugs, unless a Jupyter project's own use of them is what makes the bug reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
The policy's preferred channel is a GitHub Security Advisory opened in the repository that holds the bug
-
Pick the right repository before you file.
-
The repository is jupyter-server/jupyter_server with an underscore; the hyphenated name does not resolve
-
Say whether the finding needs a multi-user deployment.
-
State which authentication and authorisation configuration the target ran
Not accepted
-
A user executing code in their own kernel, which is the entire purpose of a notebook server.
-
A server an operator deliberately started with authentication disabled or bound to a public interface without a token
-
Upstream Tornado, IPython or Python dependency bugs, unless a Jupyter project's own use of them is what makes the bug reachable
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-44182 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g. | Critical 10.0 | 16 Jul 2026 |
| CVE-2026-44181 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables (KERNEL_XXX) used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection (SSTI). By including Jinja2 template expressions it is possible to | Critical 10.0 | 16 Jul 2026 |
| CVE-2026-44180 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 (root), and this restriction can be bypassed using a specially crafted KERNEL_UID or KERNEL_GID value. This input | Critical 9.8 | 16 Jul 2026 |
| CVE-2026-54527 | JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0. | Critical 9.3 | 8 Jul 2026 |
| CVE-2026-54528 | JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0. | High 7.1 | 8 Jul 2026 |
| CVE-2026-44727 | Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with | Critical 9.3 | 22 Jun 2026 |
| CVE-2026-6657 | A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of `re.match()` for validating the `Origin` header, which only anchors at the start of the string. This allows attacker-controlled domains such as `trusted.example.com.evil.com` to pass validation again | High 8.8 | 3 Jun 2026 |
| CVE-2026-5422 | A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the | High 8.1 | 2 Jun 2026 |
| CVE-2026-40864 | JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigge | Medium 5.4 | 22 May 2026 |
| CVE-2026-42557 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came fro | High 8.6 | 13 May 2026 |
| CVE-2026-42266 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerabi | High 8.8 | 13 May 2026 |
| CVE-2026-40110 | Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will a | High 7.6 | 5 May 2026 |
| CVE-2026-40934 | Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid | High 7.6 | 5 May 2026 |
| CVE-2026-35397 | Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" throu | High 7.6 | 5 May 2026 |
| CVE-2025-61669 | Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phi | Medium 6.3 | 5 May 2026 |
| CVE-2026-39377 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitizat | Medium 6.5 | 21 Apr 2026 |
| CVE-2026-39378 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in th | Medium 6.5 | 21 Apr 2026 |
| CVE-2026-34052 | LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. | Medium 5.9 | 3 Apr 2026 |
| CVE-2026-33709 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's ch | Medium 5.1 | 3 Apr 2026 |
| CVE-2026-33175 | OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of accoun | High 8.8 | 3 Apr 2026 |
| CVE-2025-53000 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable | High 8.5 | 17 Dec 2025 |
| CVE-2025-59842 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party | Low 2.1 | 26 Sep 2025 |
| CVE-2025-30167 | Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotecte | High 7.3 | 3 Jun 2025 |
| CVE-2023-25574 | `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticat | Critical 10.0 | 25 Feb 2025 |
| CVE-2024-43805 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as | High 7.6 | 28 Aug 2024 |
| CVE-2024-41942 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users | High 7.2 | 8 Aug 2024 |
| CVE-2024-39700 | JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting | Critical 9.9 | 16 Jul 2024 |
| CVE-2024-35225 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupy | Critical 9.6 | 11 Jun 2024 |
| CVE-2024-35178 | The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services us | High 7.5 | 6 Jun 2024 |
| CVE-2024-28233 | JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API and user's single-user server. The affected configurations are single-origin JupyterHub deployments an | High 8.1 | 27 Mar 2024 |
| CVE-2024-29033 | OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control | High 7.5 | 20 Mar 2024 |
| CVE-2024-28179 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can | Critical 9.0 | 20 Mar 2024 |
| CVE-2024-22420 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLa | Medium 6.5 | 19 Jan 2024 |
| CVE-2024-22421 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identifie | High 7.6 | 19 Jan 2024 |
| CVE-2024-22415 | jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and | High 7.3 | 18 Jan 2024 |
| CVE-2023-48311 | dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` | High 8.0 | 8 Dec 2023 |
| CVE-2023-49080 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths re | Low 3.5 | 4 Dec 2023 |
| CVE-2023-39968 | jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit `29036259` which is included in release 2.7.2. Users are adv | Medium 4.3 | 28 Aug 2023 |
| CVE-2023-40170 | jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use | Medium 4.6 | 28 Aug 2023 |
| CVE-2022-39286 | Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds. | High 8.8 | 26 Oct 2022 |
| CVE-2021-32862 | The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer). | High 7.5 | 18 Aug 2022 |
| CVE-2022-29241 | Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the | High 7.1 | 14 Jun 2022 |
| CVE-2022-29238 | Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to | Medium 4.3 | 14 Jun 2022 |
| CVE-2022-31027 | OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowed_idps configuration trait of CILogonOAuthenticator is documented to be a list of domains that indicate the institut | Medium 4.2 | 9 Jun 2022 |
| CVE-2022-24758 | The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensit | High 7.5 | 31 Mar 2022 |
| CVE-2022-24757 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacke | High 7.5 | 23 Mar 2022 |
| CVE-2022-21697 | Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed | Medium 6.3 | 25 Jan 2022 |
| CVE-2021-41247 | JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to J | Low 3.5 | 4 Nov 2021 |
| CVE-2021-41134 | nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this is | High 8.7 | 3 Nov 2021 |
| CVE-2021-39159 | BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub de | Critical 9.6 | 25 Aug 2021 |
| CVE-2021-32797 | JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action | High 7.4 | 9 Aug 2021 |
| CVE-2021-32798 | The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary | Critical 10.0 | 9 Aug 2021 |
| CVE-2020-36191 | JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account). | Medium 4.5 | 13 Jan 2021 |
| CVE-2020-26275 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affe | Medium 6.1 | 21 Dec 2020 |
| CVE-2020-26250 | OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If | Medium 6.3 | 1 Dec 2020 |
| CVE-2020-26232 | Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed | Medium 4.1 | 24 Nov 2020 |
| CVE-2020-26215 | Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a s | Medium 4.4 | 18 Nov 2020 |
| CVE-2018-21030 | Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document. | Medium 5.3 | 31 Oct 2019 |
| CVE-2019-10856 | In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255. | Medium 6.1 | 4 Apr 2019 |
| CVE-2019-10255 | An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected. | Medium 6.1 | 28 Mar 2019 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 24 Last 12 months XSS 35 % Improper access control 25 % Privilege escalation 20 % Info disclosure 20 % Latest advisories Loading the feed Overview Project Jupyter is the notebook stack: JupyterLab and the classic notebook at the front, jupyter-server underneath them, nbconvert turning documents into HTML, and JupyterHub running the whole thing multi-tenant. JupyterHub is where the value concentrates, since its unit of deployment is an entire university, national lab or SageMaker Studio tenancy, and every user on it executes arbitrary code as a matter of design. Twenty-four advisories landed across the ecosystem in the last twelve months, one of them critical in jupyter-server. Jupyter's security page states plainly that it runs no bug bounty programs and does not reward vulnerability discovery. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published policy asks for any vulnerability in a Jupyter project through a GitHub Security Advisory in the relevant repository or by email, and draws no boundary narrower than the ecosystem itself. Everything below sits inside that jupyter-server end to end: the REST API, the token and cookie authentication layer, the identity model, the XSRF protections and the handlers behind them The contents manager and the file API, covering every path where a request names a file on the server's disk The kernel protocol and the kernel provisioner path, including message signing, connection files and the ZMQ channels between a front end and a kernel JupyterLab in full: the extension system, the plugin loading path, the settings and workspace stores, and every renderer that displays output a kernel produced Output rendering and mimetype handling wherever it happens, including HTML, JavaScript, SVG, LaTeX and Markdown output, and the sanitiser that is supposed to be in front of it The classic notebook application and the nbclassic compatibility layer nbconvert in full: every exporter, the template engine, the preprocessors, and the handling of notebook content while converting it nbformat, covering notebook reading, validation, signing and the trust database that decides whether stored output is rendered JupyterHub in full: the hub API, the proxy, the OAuth flow between hub and single-user servers, and the shipped authenticators and spawners BinderHub and repo2docker, which build and run an image from a repository a stranger supplied Voila, which serves a notebook as an application to users who never see the notebook itself The terminal and console surfaces, and the file upload and download paths in every one of the above Out of scope SageMaker Studio, Vertex AI Workbench, Databricks notebooks, Google Colab and other vendor products built on the Jupyter stack: those vendors' own code and configuration belong to them Third-party extensions, kernels, authenticators and spawners that the project does not maintain A user executing code in their own kernel, which is the entire purpose of a notebook server. The finding has to cross a user, tenant or privilege boundary A server an operator deliberately started with authentication disabled or bound to a public interface without a token Upstream Tornado, IPython or Python dependency bugs, unless a Jupyter project's own use of them is what makes the bug reachable Most-valued findings Anything that crosses a user boundary on a JupyterHub deployment: reading another user's notebooks, tokens or kernel, or reaching the hub's own privileges from a single-user server. A hub is usually an entire institution Privilege escalation through a spawner, where an authenticated user influences how their server process is launched and gains more than their own account Cross-site scripting in rendered notebook output that chains into code execution, since a Jupyter XSS runs next to a kernel that already executes arbitrary code. This is the densest class in the recent record, with ten advisories on JupyterLab alone Authentication and token handling defects in jupyter-server, the component that carried the ecosystem's one critical advisory in the window Notebook trust and signature bypass in nbformat, where stored output is rendered as trusted without the signature that was supposed to authorise it Template and HTML injection in nbconvert, which converts documents from untrusted sources on servers that often run it unattended Path traversal or arbitrary read and write through the contents manager and the file API, on a server that runs as a real user with a real home directory Anything in BinderHub or repo2docker that escapes the build or the runtime container, given that both accept a repository from an anonymous stranger by design Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. The policy's preferred channel is a GitHub Security Advisory opened in the repository that holds the bug, and private vulnerability reporting is enabled on notebook, jupyterlab, jupyterhub, binderhub, nbconvert, nbformat and voila [email protected] is the documented email route. [email protected] still works, and the policy warns it may be sunset, so use the jupyter.org address Pick the right repository before you file. A rendering bug can live in JupyterLab, in nbconvert or in nbformat, and filing it in the wrong place costs days The repository is jupyter-server/jupyter_server with an underscore; the hyphenated name does not resolve Say whether the finding needs a multi-user deployment. A bug that only matters on a shared hub is scored very differently from one that hits a single-user install State which authentication and authorisation configuration the target ran, since JupyterHub's authenticators and spawners are pluggable and the boundary moves with them The project states it runs no bug bounty programs and does not reward vulnerability discovery. There is no payment to negotiate and no reward terms to accept Disclosure Coordinated privately through the GitHub advisory workflow in the affected repository, then published as a GitHub Security Advisory alongside a patched release, with the more serious ones announced on the Jupyter blog and the security mailing list. Twenty-four advisories in twelve months across five repositories means this pipeline actually moves. Expect the embargo to run to the next release of the affected package rather than to a fixed day count, and expect a fix in one repository to require coordinated releases in the others that depend on it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability