CVE-2023-39968 Open Redirect Vulnerability in jupyter-server

What is CVE-2023-39968?

CVE-2023-39968 is a medium-severity vulnerability in jupyter-server jupyter_server, published on 28 Aug 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit `29036259` which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-601

Which versions are affected by CVE-2023-39968?

3 open source packages ship an affected version, including jupyter-server. It affects 1 product.

Products include Jupyter Jupyter Server.

How do I fix CVE-2023-39968?

Upgrade jupyter-server to 2.7.2 or later.

Is CVE-2023-39968 being exploited?

There is no known exploitation of CVE-2023-39968 in the wild and no public exploit code.

Other vulnerabilities in jupyter-server jupyter_server

• CVE-2026-44727 Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP Critical 9.3
• CVE-2026-35397 jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix High 7.6
• CVE-2026-40110 jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat High 7.6
• CVE-2026-40934 jupyter-server authentication cookies remain valid after password reset due to static cookie secret High 7.6
• CVE-2024-35178 Jupyter server on Windows discloses Windows user password hash High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-39968, GHSA-r726-vmfq-j9j3, PYSEC-2023-155, UBUNTU-CVE-2023-39968.