Medium severity · published Nov 24, 2020
CVE-2020-26232
Jupyter Server before version 1.0.6 has an Open redirect vulnerability
5.4
CVSS
1%
EPSS
No
On KEV
Description
Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jupyter Server · Jupyter
before 1.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26232
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26232
Release Notes
https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18
Patch
https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157
Third Party Advisory
https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v
More from Jupyter Server
8.8
CVE-2026-6657
CORS Origin Validation Bypass in jupyter-server
8.8
CVE-2026-35397
jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix
8.8
CVE-2022-29241
Jupyter Server provides the backend (i.e
8.1
CVE-2026-5422
Path Traversal in jupyter/jupyter
7.5
CVE-2024-35178
The Jupyter Server provides the backend for Jupyter web applications