---
id: CVE-2020-26232
aliases:
  - GHSA-grfj-wjv9-4f9v
  - PYSEC-2020-234
title: Open redirect in Jupyter Server
summary: Open redirect in Jupyter Server
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N'
vendor: jupyter-server
product: jupyter-server
ecosystem: pip
affected:
  - jupyter-server < 1.0.6
patched:
  - jupyter-server 1.0.6
published: '2020-11-24'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:48:35.837724184Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-grfj-wjv9-4f9v'
references:
  - url: >-
      https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-26232'
  - url: >-
      https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157
  - url: 'https://github.com/jupyter-server/jupyter_server'
  - url: >-
      https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2020-234.yaml
tags:
  - osv
  - pip
epss: 0.01004
epssPercentile: 0.61469
ingestedAt: '2026-09-12T03:13:01.697Z'
---

## Overview

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.

All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet.

This originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh

### Patches

_Has the problem been patched? What versions should users upgrade to?_

jupyter_server 1.0.6

### References

[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: zhuonan li of Alibaba Application Security Team

## Affected packages

- `jupyter-server < 1.0.6`

## Remediation

Upgrade to a patched release:

- `jupyter-server 1.0.6`