Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/41196?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/41196?format=api", "purl": "pkg:pypi/jupyter-server@2.14.1", "type": "pypi", "namespace": "", "name": "jupyter-server", "version": "2.14.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.18.0", "latest_non_vulnerable_version": "2.18.0", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37309?format=api", "vulnerability_id": "VCID-4afw-qvxb-27eg", "summary": "Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.", "references": [ { "reference_url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50018?format=api", "purl": "pkg:pypi/jupyter-server@2.18.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/jupyter-server@2.18.0" } ], "aliases": [ "CVE-2025-61669", "GHSA-qh7q-6qm3-653w", "PYSEC-2026-67" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4afw-qvxb-27eg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37315?format=api", "vulnerability_id": "VCID-bj7m-yew4-3qgz", "summary": "Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.", "references": [ { "reference_url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50018?format=api", "purl": "pkg:pypi/jupyter-server@2.18.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/jupyter-server@2.18.0" } ], "aliases": [ "CVE-2026-40934", "GHSA-5mrq-x3x5-8v8f", "PYSEC-2026-69" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bj7m-yew4-3qgz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37314?format=api", "vulnerability_id": "VCID-bnpq-rekd-ekdc", "summary": "Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named \"test\", the API permits access to a sibling directory named \"testtest\" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named \"user1\" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. \n\nVersion 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory.", "references": [ { "reference_url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50018?format=api", "purl": "pkg:pypi/jupyter-server@2.18.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/jupyter-server@2.18.0" } ], "aliases": [ "CVE-2026-35397", "GHSA-5789-5fc7-67v3", "PYSEC-2026-68" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bnpq-rekd-ekdc" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36798?format=api", "vulnerability_id": "VCID-28rs-8cqr-bybp", "summary": "The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack this password to gain access to the Windows machine hosting the Jupyter server, or access other network-accessible machines or 3rd party services using that credential. Or an attacker perform an NTLM relay attack without cracking the credential to gain access to other network-accessible machines. This vulnerability is fixed in 2.14.1.", "references": [ { "reference_url": "https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2df", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2df" }, { "reference_url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-hrw6-wg82-cm62", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-hrw6-wg82-cm62" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/41196?format=api", "purl": "pkg:pypi/jupyter-server@2.14.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4afw-qvxb-27eg" }, { "vulnerability": "VCID-bj7m-yew4-3qgz" }, { "vulnerability": "VCID-bnpq-rekd-ekdc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/jupyter-server@2.14.1" } ], "aliases": [ "CVE-2024-35178", "PYSEC-2024-165" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-28rs-8cqr-bybp" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/jupyter-server@2.14.1" }