CVE-2026-86258

nbviewer through 1.0.1 contains a path traversal vulnerability (CWE-22) in LocalFileHandler.can_show(), which validates requested paths against the configured serving root using a plain string-prefix comparison instead of resolving and checking the canonical filesystem path. A remote, unauthenticated attacker can send HTTP requests whose paths merely begin with the root as a textual prefix - such as a sibling directory whose name shares that prefix - and the flawed check treats files there as inside the root. Successful exploitation discloses unintended notebooks and potentially credentials or configuration files stored in neighboring directories; the CVSS 4.0 score of 8.2 (High) reflects high confidentiality impact with no integrity or availability impact. Only deployments using nbviewer's local file handler are exposed, and the AT:P attack requirement means exploitation also depends on conditions such as sensitive files actually existing in predictable sibling locations. No public proof-of-concept, CISA KEV entry, or confirmed in-the-wild exploitation is known, and EPSS estimates roughly a 0.4% probability of exploitation within 30 days.

What to do: Upgrade nbviewer to a release newer than 1.0.1 when a patched version is published, as no fixed version is cited in the current advisory data. Until then, disable the local file handler if it is not needed, or reconfigure the served root so that no sensitive sibling directories share its path as a textual prefix, and review access logs for requests that returned files from outside the root. Verify exposure by attempting to fetch known files (such as configuration or credential files) from sibling directories via crafted paths.