---
id: CVE-2019-10255
aliases:
  - GHSA-rv62-4pmj-xw6h
  - PYSEC-2026-647
title: Open Redirect vulnerability in jupyterhub and notebook
summary: Open Redirect vulnerability in jupyterhub and notebook
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: notebook
product: notebook
ecosystem: pip
affected:
  - notebook < 5.7.8
  - jupyterhub < 0.9.6
patched:
  - notebook 5.7.8
  - jupyterhub 0.9.6
published: '2019-04-02'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rv62-4pmj-xw6h'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-10255'
  - url: >-
      https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb
  - url: >-
      https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b
  - url: >-
      https://github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed
  - url: >-
      https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4
  - url: 'https://github.com/advisories/GHSA-rv62-4pmj-xw6h'
  - url: 'https://github.com/jupyter/notebook'
  - url: 'https://github.com/jupyter/notebook/compare/05aa4b2...16cf97c'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO
tags:
  - osv
  - pip
epss: 0.01756
epssPercentile: 0.76976
ingestedAt: '2026-07-08T18:25:53.024Z'
---

## Overview

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.

## Affected packages

- `notebook < 5.7.8`
- `jupyterhub < 0.9.6`

## Remediation

Upgrade to a patched release:

- `notebook 5.7.8`
- `jupyterhub 0.9.6`