Cross-site scripting in jupyterhub - #VU162713
Published: November 9, 2026
Vulnerability identifier: #VU162713
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user to execute script as another user against JupyterHub.
The vulnerability exists due to improper neutralization of malicious share links in /hub/accept-share when non-default user-initiated sharing is enabled. An authenticated user with the users:shares scope can craft a malicious share link that executes script in a victim's browser when a victim with whom the attacker has permission to share access visits it.
Affected software
jupyterhub
Remediation
Install security update from vendor's website.
jupyterhub - update to 5.5.1