CVE-2026-86258: nbviewer through 1.0.1 Path Traversal via LocalFileHandler
nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.canshow() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nbviewer (LocalFileHandler)to a version that resolves this vulnerability.Fixed in 1.0.1 - Compensating control
Apply path traversal hardening for nbviewer’s LocalFileHandler.can_show() by enforcing proper path validation (prevent sibling-directory reads outside the configured root) rather than string-prefix comparisons.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using nbviewer through version 1.0.1 with the LocalFileHandler configured are exposed. Files in sibling directories may be readable when their paths share the configured root directory's textual prefix.
Does exploitation require authentication or user interaction?
No. The listed vector indicates network access with no privileges and no user interaction required, although exploitation has high attack complexity.
What information could be disclosed?
An attacker may read unintended notebooks and credentials stored in files outside the configured root, specifically in sibling directories reachable through the prefix-validation flaw.