Input validation error in jupyterhub - #VU162721
Published: November 9, 2026
Vulnerability identifier: #VU162721
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to interfere with URL handling in JupyterHub deployments that permit users to sign up with arbitrary usernames.
The vulnerability exists due to insufficient validation of user and service names used as URL components in JupyterHub. A remote attacker can register an account with a malicious username to trigger the URL handling interference.
Affected software
jupyterhub
Remediation
Install security update from vendor's website.
jupyterhub - addressed in versions 5.5.3, 6.1.0