PT-2026-53453 · Pypi · Jupyter-Remote-Desktop-Proxy

Publicado 2026-06-29 · Atualizado 2026-06-29

OSV

CVSS v4.0

9.0

Crítica

Vetor base

AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Summary

jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network.

This vulnerability does not affect users having TurboVNC as the vncserver executable.

Credits

This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

Correção

Identificadores relacionados

PYSEC-2026-365

Produtos afetados

Jupyter-Remote-Desktop-Proxy

Referências · 7

• https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d · Nota
• https://github.com/jupyterhub/jupyter-remote-desktop-proxy · Nota
• https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7 · Nota
• https://pypi.org/project/jupyter-remote-desktop-proxy · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-32428 · Nota de Segurança
• https://github.com/advisories/GHSA-vrq4-9hc3-cgp7 · Nota
• https://osv.dev/vulnerability/PYSEC-2026-365 · Aviso do Fabricante