Detections
Analytics

SCA: security update for jupyter-server (GHSA-5789-5fc7-67v3)

high Tenable Cloud Security Plugin ID 441557

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path
 traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and
 access sibling directories whose names begin with the same prefix as the root_dir. For example, with a
 root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted
 request to the /api/contents endpoint using encoded path components. An attacker can read, write, and
 delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes
 are particularly at risk, as a user with a directory named "user1" could access directories for user10
 through user19 and beyond. A user who can choose a single-character folder name could gain access to a
 significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder
 names do not share a common prefix with any sibling directory. (CVE-2026-35397)

Solution

Update the jupyter-server library and its related packages to version 2.18.0 or later.

See Also

https://github.com/advisories/GHSA-5789-5fc7-67v3

Plugin Details

Severity: High

ID: 441557

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 5/8/2026

Updated: 6/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.03

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-35397

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.6

Threat Score: 6.8

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/5/2026

Vulnerability Publication Date: 5/5/2026

Reference Information

CVE: CVE-2026-35397

cwe: CWE-22