CVE-2026-86258

Name of the Vulnerable Software and Affected Versions nbviewer versions prior to 1.0.2

Description A path traversal issue exists in the can show() function of the LocalFileHandler. The system uses string-prefix comparison instead of proper path validation, allowing attackers to read files from sibling directories outside the configured root. This occurs when requesting paths that share the root as a textual prefix, which can lead to the disclosure of unintended notebooks and credentials.

Recommendations Update nbviewer to version 1.0.2 or later. As a temporary workaround, restrict access to the can show() function within the LocalFileHandler to minimize the risk of exploitation.