VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 4, 2023· Updated Feb 13, 2025

Jupyter Server errors include tracebacks with path information

CVE-2023-49080

Description

The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit 0056c3aa52 which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jupyter Server leaks internal path information through error tracebacks to authenticated users; fixed in 2.11.2.

The vulnerability resides in Jupyter Server's error handling for API requests. When an unhandled error occurs during processing of a request from an authenticated user, the server includes the full Python traceback in the JSON error response [1]. This traceback can contain local path information that might reveal details about the server's file system structure.

Exploitation requires the attacker to be an authenticated user of the Jupyter server. Since the attacker already has arbitrary execution permissions within the same environment, the exposed paths are not considered highly sensitive. The attack surface is limited to authenticated API endpoints that may trigger unhandled exceptions [1].

The impact is limited to information disclosure of file paths on the server. While the paths themselves may not be critical, they could aid an attacker in further reconnaissance or targeted attacks. However, the requirement for prior authentication significantly reduces the severity.

A fix has been implemented in commit 0056c3aa52 which modifies the error response to include an empty traceback field for backward compatibility, while removing the actual traceback content [4]. This fix is included in Jupyter Server version 2.11.2. Users are advised to upgrade. No workarounds are available [1].

References
  1. NVD - CVE-2023-49080
  2. Merge pull request from GHSA-h56g-gq9v-vc8r · jupyter-server/jupyter_server@0056c3a

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
jupyter-serverPyPI
< 2.11.22.11.2

Affected products

4

Patches

1
0056c3aa52cb

Merge pull request from GHSA-h56g-gq9v-vc8r

https://github.com/jupyter-server/jupyter_serverMin RKDec 4, 2023via ghsa
commit
2 files changed · +4 −5
  • jupyter_server/base/handlers.py+3 −2 modified
    @@ -10,7 +10,6 @@
 import mimetypes
 import os
 import re
-import traceback
 import types
 import warnings
 from http.client import responses
@@ -748,7 +747,9 @@ def write_error(self, status_code: int, **kwargs: Any) -> None:
             else:
                 reply["message"] = "Unhandled error"
                 reply["reason"] = None
-                reply["traceback"] = "".join(traceback.format_exception(*exc_info))
+                # backward-compatibility: traceback field is present,
+                # but always empty
+                reply["traceback"] = ""
         self.log.warning("wrote error: %r", reply["message"], exc_info=True)
         self.finish(json.dumps(reply))
  • jupyter_server/services/kernels/handlers.py+1 −3 modified
    @@ -5,7 +5,6 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 import json
-from traceback import format_tb
 
 try:
     from jupyter_client.jsonutil import json_default
@@ -102,8 +101,7 @@ async def post(self, kernel_id, action):
             except Exception as e:
                 message = "Exception restarting kernel"
                 self.log.error(message, exc_info=True)
-                traceback = format_tb(e.__traceback__)
-                self.write(json.dumps({"message": message, "traceback": traceback}))
+                self.write(json.dumps({"message": message, "traceback": ""}))
                 self.set_status(500)
             else:
                 model = await ensure_async(km.kernel_model(kernel_id))

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.