CyberRota Analysis
AI-GeneratedThe vulnerability in nbviewer versions up to 1.0.1 allows attackers to exploit a path traversal flaw in the LocalFileHandler.can_show() method, enabling unauthorized access to files in sibling directories outside the intended root. This could lead to the exposure of sensitive notebooks and credentials. Organizations using nbviewer should prioritize patching this vulnerability to mitigate potential data leaks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.