AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JupyterGHSA-r726-vmfq-j9j3

Open Redirect Vulnerability in jupyter-server

Jupyter

CVE-2023-39968 · Published Aug 29, 2023 · updated Sep 10, 2026

Medium6.1
Fix: upgrade to 2.7.2 or later
GitHub advisory

Impact

Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs.

Patches

Upgrade to Jupyter Server 2.7.2

Workarounds

None.

References

Vulnerability reported by user davwwwx via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).

  • https://blog.xss.am/2023/08/cve-2023-39968-jupyter-token-leak/

Affected versions

PackageAffectedFixed in
jupyter-server
PyPI
< 2.7.22.7.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-601
Also known as
CVE-2023-39968, PYSEC-2023-155

More Jupyter advisories

All Jupyter
High 7.5Jun 6, 2024Jupyter server on Windows discloses Windows user password hashCVE-2024-35178fixed in 2.14.1High 8.1Mar 28, 2024Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie TossingCVE-2024-28233fixed in 4.1.0High 7.6Jan 19, 2024JupyterLab vulnerable to potential authentication and CSRF tokens leakCVE-2024-22421fixed in 3.6.7 +2Medium 6.5Jan 19, 2024JupyterLab vulnerable to SXSS in Markdown PreviewCVE-2024-22420fixed in 4.0.11 +1Medium 4.3Dec 5, 2023jupyter-server errors include tracebacks with path informationCVE-2023-49080fixed in 2.11.2Medium 4.6Aug 29, 2023cross-site inclusion (XSSI) of files in jupyter-serverCVE-2023-40170fixed in 2.7.2