nbviewer Path Traversal Vulnerability Exposes Sensitive Files

Executive Summary

This vulnerability is a path traversal issue in nbviewer through version 1.0.1. The LocalFileHandler.can_show() function uses string-prefix comparison instead of proper path validation, allowing attackers to read files from sibling directories outside the configured root by crafting paths that share the root as a textual prefix.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your nbviewer instance is running version 1.0.1 or earlier. Inspect the LocalFileHandler.can_show() function in nbviewer/providers/local/handlers.py for improper path validation using string-prefix comparison instead of proper path containment checks.

Useful 0 Not Useful 0

Impact Analysis

Attackers could access unintended notebooks and potentially sensitive credentials stored in sibling directories. The impact is limited to sibling directories sharing the root directory as a string prefix, not arbitrary directory traversal like accessing system files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, including credentials and notebooks, which may contain personal or confidential data. For GDPR, this could result in violations of data protection principles if personal data is exposed. For HIPAA, it may compromise protected health information if such data is stored in accessible files.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade nbviewer to a version that includes the fix for CVE-2026-86258. Ensure the LocalFileHandler.can_show() function uses proper path containment validation, such as os.path.commonpath or similar methods, to prevent path traversal attacks.

Useful 0 Not Useful 0