Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

jupyterhub

8 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 high, 3 medium, 1 low
Weekly downloads
85.5K
Dependents
155
Registry
PyPI

Advisories 8

  • CVE-2026-54338Medium 5.3

    JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

    Affected: fixed in 5.5.0.

  • CVE-2026-40864Medium 5.4

    JupyterHub: Cross-origin form POSTs bypass XSRF

    Affected: from 4.1.0, fixed in 5.4.5.

  • CVE-2026-33709Medium 5.1

    JupyterHub has an Open Redirect Vulnerability

    Affected: fixed in 5.4.4.

  • JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

    Affected: fixed in 4.1.6; from 5.0.0, fixed in 5.1.0.

  • XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing

    Affected: fixed in 4.1.0.

  • incomplete logout in JupyterHub

    Affected: from 1.0.0, fixed in 1.5.0.

  • JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to…

    Affected: fixed in 1.2.0b1; fixed in 1.2.0b1.

  • An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before…

    Affected: fixed in 0.9.6.