Description
Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jupyter-server | jupyter-scheduler | >= 1.0.0, <= 1.1.5, = 1.2.0, >= 1.3.0, <= 1.8.1, >= 2.0.0, <= 2.5.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jupyter-server | No fix yet | — |
| Ubuntu 26.04 LTS | jupyter-server | No fix yet | — |
| Ubuntu 25.10 | jupyter-server | No fix yet | — |
| Ubuntu 24.04 LTS | jupyter-server | No fix yet | — |
| Ubuntu 22.04 LTS | jupyter-server | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | jupyter-scheduler | >= 1.0.0, < 1.1.6 | 1.1.6 | GHSA-v9g2-g7j4-4jxc |
| PyPI | jupyter-scheduler | >= 1.2.0, < 1.2.1 | 1.2.1 | GHSA-v9g2-g7j4-4jxc |
| PyPI | jupyter-scheduler | >= 1.3.0, < 1.8.2 | 1.8.2 | GHSA-v9g2-g7j4-4jxc |
| PyPI | jupyter-scheduler | >= 2.0.0, < 2.5.2 | 2.5.2 | GHSA-v9g2-g7j4-4jxc |
| PyPI | jupyter-scheduler | >= 1.0.0, < 1.1.6 · >= 1.2.0, < 1.2.1 · >= 1.3.0, < 1.8.2 · >= 2.0.0, < 2.5.2 | 1.1.6, 1.2.1, 1.8.2, 2.5.2 | PYSEC-2026-1479 |