Description
nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jupyter | nbviewer | ≤ 1.0.1 | — |
References
- GitHub Issue #1115 issue-tracking
- LocalFileHandler.can_show() at 1.0.1 technical-description
- Fix path-containment bypass in LocalFileHandler.can_show (PR #1116) patch
- https://github.com/jupyter/nbviewer product
- VulnCheck Advisory: nbviewer through 1.0.1 Path Traversal via LocalFileHandler third-party-advisory