8.2
High
CVE-2026-86258 nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix…
Description
nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| nbviewer 1.0 | earliest → 1.0.1 | No fix stated |
References
- GitHub Issue #1115 github.com
- LocalFileHandler.can_show() at 1.0.1 github.com
- Fix path-containment bypass in LocalFileHandler.can_show (PR #1116) github.com
- github.com github.com
- VulnCheck Advisory: nbviewer through 1.0.1 Path Traversal via LocalFileHandler www.vulncheck.com
Timeline
- Published
- Last modified