Datalore vulnerabilities and CVEs
Known vulnerabilities affecting Datalore, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
14 vulnerabilities tracked.
- 9.0 In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
- 8.1 In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
- 7.5 In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
- 7.4 In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
- 6.8 In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account
- 6.5 In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
- 6.3 In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
- 5.9 In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
- 5.9 In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
- 5.4 In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
- 5.4 In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
- 5.3 In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content…
- 4.3 In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
- 2.7 In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Datalore is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Linux Red Hat Enterprise Linux 9 Chrome Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 macOS Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Zephyr Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 10.0 Extended Update Support Android Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Windows Server 2022 iOS and iPadOS Windows 11 version 26H1 Windows 11 Version 24H2 Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 25H2