SB2026110969 - Multiple vulnerabilities in jupyterhub

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows an authenticated user to execute script as another user against JupyterHub.

The vulnerability exists due to improper neutralization of malicious share links in /hub/accept-share when non-default user-initiated sharing is enabled. An authenticated user with the users:shares scope can craft a malicious share link that executes script in a victim's browser when a victim with whom the attacker has permission to share access visits it.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an administrator with filtered user or group permissions to create users or groups outside their authorized scope in JupyterHub.

The vulnerability exists due to improper scope enforcement during user and group creation in deployments configured with custom roles granting filtered administrative access. An administrator with filtered user or group permissions can submit creation requests for out-of-scope users or groups without gaining administrative access to them.

Remediation

Install update from vendor's website.

References

• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-c4gm-pwx9-9w8j
• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-69wv-m5fw-2fhp