Open redirect in Jupyter Server
Impact
What kind of vulnerability is it? Who is impacted?
Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.
All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
This originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh
Patches
Has the problem been patched? What versions should users upgrade to?
jupyter_server 1.0.6
References
For more information
If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.
Credit: zhuonan li of Alibaba Application Security Team
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | jupyter-server | < 1.0.6 | 1.0.6 |
Referencias
- https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v
- https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18
- https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157
- https://nvd.nist.gov/vuln/detail/CVE-2020-26232
- https://github.com/jupyter-server/jupyter_server
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2020-234.yaml
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N- Debilidad (CWE)
CWE-601- Plataforma
- Python (PyPI)
- Paquete
jupyter-server- Publicada
- 24.11.2020
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2020-234 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-grfj-wjv9-4f9v - CC BY 4.0
Historial de vulnerabilidades: jupyter-server
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 14
- Primera → última
- 11.2020 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 7
- Media 6
Divulgaciones por año
- 2020: 2
- 2021: 0
- 2022: 2
- 2023: 3
- 2024: 1
- 2025: 0
- 2026: 6
-
Open redirect in Jupyter Server esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.