CVE-2023-39968Medium· 6.1▾ SunlitOpen Redirect Vulnerability in jupyter-server
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs.
Upgrade to Jupyter Server 2.7.2
None.
Vulnerability reported by user davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
jupyter-server < 2.7.2Upgrade to a patched release:
jupyter-server 2.7.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-40170Medium· 4.6cross-site inclusion (XSSI) of files in jupyter-server
CVE-2025-61669MediumJupyter Server has an open redirection vulnerability in `next` query parameter
CVE-2022-29241High· 7.1Jupyter server Token bruteforcing
CVE-2024-35178High· 7.5Jupyter server on Windows discloses Windows user password hash
CVE-2023-49080Medium· 4.3jupyter-server errors include tracebacks with path information
CVE-2020-26232Medium· 4.1Open redirect in Jupyter Server