JupyterGHSA-rv62-4pmj-xw6h
Open Redirect vulnerability in jupyterhub and notebook
Medium6.1CVE-2019-10255 · Published Apr 2, 2019 · updated Jul 13, 2026
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyterhub PyPI | < 0.9.6 | 0.9.6 |
| notebook PyPI | < 5.7.8 | 5.7.8 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-601
- Also known as
- CVE-2019-10255, PYSEC-2026-2683, PYSEC-2026-647
- nvd.nist.gov/vuln/detail/CVE-2019-10255
- github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb
- github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b
- github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed
- blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4
- github.com/advisories/GHSA-rv62-4pmj-xw6h
- github.com/jupyter/notebook
- github.com/jupyter/notebook/compare/05aa4b2...16cf97c
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 182020 | Open redirect in Jupyter Notebook Low4.4Nov 18, 2020 | Low4.4 | 6.1.5 |
| Nov 82019 | Cross-site scripting in Jupyter NotebookMedium5.3Nov 8, 2019 | Medium5.3 | 5.5.0rc1 |
| Apr 92019 | Jupyter Notebook open redirect vulnerabilityMedium6.1Apr 9, 2019 | Medium6.1 | 5.7.8 |
| Nov 212018 | Jupyter Notebook XSS via directory nameMedium6.1Nov 21, 2018 | Medium6.1 | 5.7.2 |
| Nov 212018 | Jupyter Notebook XSS via untrusted notebooksMedium6.1Nov 21, 2018 | Medium6.1 | 5.7.1 |
| Jul 122018 | Jupyter Notebook file bypasses sanitization, executes JavaScriptHigh7.8Jul 12, 2018 | High7.8 | 5.4.1 |