Is CVE-2026-86258 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86258?

CVE-2026-86258 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-86258

Description

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefix, disclosing unintended notebooks and credentials.