Skip to main content

Regular Expression without Anchors

CVE-2026-40110

High
7.6/10

Summary

Jupyter Server is the backend for Jupyter web applications. In versions through 2.17.0, the Origin header validation uses Python's "re.match()" to check incoming origins against the" allow_origin_pat" configuration value. Because "re.match()" only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • REQUIRED
  • LOW
  • HIGH
  • NONE

CWE-777 - Regular Expression without Anchors

The software uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.

References

Advisory Timeline

  • Published