CVE-2020-26215

Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.

• CWE-601
• CWE-601

• https://github.com/jupyter/notebook/commit/3cec4bbe21756de9f0c4bccf18cf61d840314d74Patch, Third Party Advisory
• https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqhThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/12/msg00004.htmlThird Party Advisory
• https://github.com/jupyter/notebook/commit/3cec4bbe21756de9f0c4bccf18cf61d840314d74Patch, Third Party Advisory
• https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqhThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/12/msg00004.htmlThird Party Advisory

Published

Nov 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2621Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26210In BookStack before version 0.30.4, a user with permissions …8.7
• CVE-2020-26211In BookStack before version 0.30.4, a user with permissions …8.7
• CVE-2020-26212GLPI stands for Gestionnaire Libre de Parc Informatique and …6.5
• CVE-2020-26213In teler before version 0.0.1, if you run teler inside a Doc…7.5
• CVE-2020-26214In Alerta before version 8.1.0, users may be able to bypass …9.8
• CVE-2020-26216TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.…6.1
• CVE-2020-26217XStream before version 1.4.14 is vulnerable to Remote Code E…8.8
• CVE-2020-26218touchbase.ai before version 2.0 is vulnerable to Cross-Site …6.1
• CVE-2020-26219touchbase.ai before version 2.0 is vulnerable to Open Redire…6.1
• CVE-2020-2622Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26220toucbase.ai before version 2.0 leaks information by not stri…3.5