psf-jupyter-check(8)

Script: /opt/psf-security-patches/jupyter/jupyter-check.sh. Tool page: Jupyter and nbconvert. Source. With the package installed: man psf-jupyter-check.

Jupyter Server and nbconvert October 2026: read-only checker  (v1)
CVE-2026-114135 (Jupyter Server, gateway kernel authorization bypass)
CVE-2026-114140 (nbconvert, path traversal file write)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

CVE-2026-114135  Jupyter Server 2.0.0 up to 2.6.0. When GatewayClient.url is set,
                 the normal kernel WebSocket handler is replaced by a gateway
                 handler that authenticates the user but never asks the
                 configured Authorizer whether that user may EXECUTE on kernels.
                 A user the Authorizer denies can still open a kernel channel and
                 send messages to the upstream kernel. CVSS 8.8. Fixed: 2.6.0.
                 It only matters when BOTH are true: a gateway is configured, AND
                 a restrictive Authorizer is in use. With the default
                 AllowAllAuthorizer nobody is denied, so there is nothing to
                 bypass. Even in 2.6.0 and later the bypass remains possible if a
                 deployment manually registers the deprecated
                 jupyter_server.gateway.handlers module.

CVE-2026-114140  nbconvert 5.4.0 up to 7.17.2. ExtractOutputPreprocessor joins the
                 attacker-controlled "filename" in a cell's output metadata to the
                 output directory without checking the result, so converting a
                 MALICIOUS NOTEBOOK to markdown, LaTeX, reStructuredText or
                 AsciiDoc writes attacker-controlled data to arbitrary locations
                 the victim can write to. Needs the victim to convert the notebook
                 (user interaction). CVSS 8.8 (some trackers 9.0). Fixed: 7.17.2.

This script is read-only. It finds installed copies (dist-info and egg-info) and
declared pins (requirements, poetry.lock, uv.lock, pdm.lock, Pipfile.lock), and for
Jupyter Server reads the Jupyter configuration files for GatewayClient.url and
authorizer_class. It cannot see settings given only on the command line or in the
environment (JUPYTER_GATEWAY_URL, --gateway-url): it reads the arguments of running
jupyter processes for those, and says so when it cannot.

Usage:
  ./jupyter-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /usr/lib /usr/local/lib /opt /srv /var/www
                   /var/lib /home /root). Exit 0 = nothing exposed, 1 = an affected
                   nbconvert, or an affected Jupyter Server with a gateway and a
                   custom authorizer.
  version          print the script version.
Containers: with no directory argument the check also reads the project files it needs from
running docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them), through a
read-only probe, and judges them like host projects. The copies are temporary: a path shown as
.../docker_NAME/PATH is the PATH inside the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.