CVE-2023-49080
Jupyter Server errors include tracebacks with path information
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Jupyter Server errors include tracebacks with path information
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-49080- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2023-0104
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-0104- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h56g-gq9v-vc8r
jupyter-server errors include tracebacks with path information
Impact
Unhandled errors in API requests include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment.
Patches
jupyter-server PATCHED_VERSION no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty.
Workarounds
None
- Record
GHSA-h56g-gq9v-vc8r- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-49080- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
Jupyter Server errors include tracebacks with path information
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-49080- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-49080
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
DEBIAN-CVE-2023-49080- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-h56g-gq9v-vc8r
jupyter-server errors include tracebacks with path information
Impact
Unhandled errors in API requests include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment.
Patches
jupyter-server PATCHED_VERSION no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty.
Workarounds
None
- Record
GHSA-h56g-gq9v-vc8r- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVPYSEC-2023-272
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
PYSEC-2023-272- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-49080
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
UBUNTU-CVE-2023-49080- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13489-1 No score
python310-jupyter-server-2.11.2-1.1 on GA media
These are all security issues fixed in the python310-jupyter-server-2.11.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13489-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12012-1 No score
python313-jupyter-server-2.20.0-1.3 on GA media
These are all security issues fixed in the python313-jupyter-server-2.20.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12012-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jupyter-serverPyPI |
before 2.11.2 | 2.11.2 |
jupyter-serverDebian:12 |
All versions, plus listed versions 1.23.3-11.23.3-22.14.0-12.14.2-12.14.2-2 Show 9 moreShow less2.14.2-32.14.2-42.14.2-52.15.0-12.17.0-12.20.0-12.20.0-22.20.0-32.9.1-1 |
None known |
jupyter-serverDebian:13 |
before 2.14.2-1 | 2.14.2-1 |
jupyter-serverDebian:14 |
before 2.14.2-1 | 2.14.2-1 |
jupyter-serverPyPI |
before 2.11.2, plus listed versions 0.0.00.0.10.0.20.0.30.0.4 Show 45 moreShow less0.0.50.1.00.1.10.2.00.2.10.3.01.0.01.0.0rc01.0.0rc11.0.0rc101.0.0rc111.0.0rc121.0.0rc131.0.0rc141.0.0rc151.0.0rc161.0.0rc21.0.0rc31.0.0rc41.0.0rc51.0.0rc61.0.0rc71.0.0rc81.0.0rc91.0.11.0.101.0.111.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.10.01.10.11.10.21.11.01.11.1 |
2.11.2 |
jupyter-serverUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.2-11.13.1-1 |
None known |
jupyter-serverUbuntu:24.04:LTS |
All versions, plus listed versions 1.23.3-11.23.3-2 |
None known |
jupyter-serverUbuntu:25.10 |
All versions, plus listed versions 2.14.2-52.15.0-1 |
None known |
jupyter-serverUbuntu:26.10 |
All versions, plus listed versions 2.17.0-12.20.0-3 |
None known |
jupyter-serverUbuntu:26.04:LTS |
All versions, plus listed versions 2.15.0-12.17.0-1 |
None known |
python-jupyter-serveropenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.20.0-1.3 | 2.20.0-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-49080 is a low vulnerability (CVSS 3.5) in Jupyter Server, published December 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in jupyter-server 2.11.2.
References
github.com/jupyter-server/jupyter_server/security/advisories/GHSA-h56g-gq9v-vc8r
lists.fedoraproject.org/archives/list/[email protected]/message/62LO7PPIAMLIDEKUOORXLHKLGA6QPL77
nvd.nist.gov/vuln/detail/CVE-2023-49080
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2023-49080
ubuntu.com/security/CVE-2023-49080
cve.org/CVERecord?id=CVE-2023-49080
suse.com/security/cve/CVE-2023-49080
Left out here: 91 versions. The JSON record has them.