PT-2026-53453 · Pypi · Jupyter-Remote-Desktop-Proxy

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v4.0

9.0

Critical

Base vector

AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Summary

jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network.

This vulnerability does not affect users having TurboVNC as the vncserver executable.

Credits

This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

Fix

Related Identifiers

PYSEC-2026-365

Affected Products

Jupyter-Remote-Desktop-Proxy

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-32428 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-365 · Vendor Advisory
• https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d · Note
• https://github.com/jupyterhub/jupyter-remote-desktop-proxy · Note
• https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7 · Note
• https://pypi.org/project/jupyter-remote-desktop-proxy · Note
• https://github.com/advisories/GHSA-vrq4-9hc3-cgp7 · Note