CVE-2026-86258: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jupyter nbviewer

The vulnerability in jupyter nbviewer (<=1.0.1) arises from improper pathname limitation in the LocalFileHandler.can_show() function. Instead of correctly validating file paths to restrict access within a configured root directory, the method uses a string-prefix comparison. This flawed logic enables an attacker to perform path traversal by requesting paths that share the root as a textual prefix but actually point to sibling directories outside the root. As a result, unauthorized file disclosure of notebooks and credentials is possible.

An attacker without privileges can exploit this vulnerability to read arbitrary files outside the intended directory root on the server hosting nbviewer. This can lead to disclosure of sensitive information such as notebooks and credentials, potentially compromising confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing vulnerable versions of nbviewer to untrusted networks or users. Monitor vendor channels for updates and apply patches promptly once released.