{"id":"CVE-2020-26232","aliases":["DEBIAN-CVE-2020-26232","EUVD-2020-0090","GHSA-grfj-wjv9-4f9v","PYSEC-2020-234","openSUSE-SU-2024:11233-1","openSUSE-SU-2024:14143-1","openSUSE-SU-2026:12012-1"],"status":"published","title":"Open redirect in Jupyter Server","description":"Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01004,"percentile":0.63197,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2020-11-24T21:10:14Z","modified":"2026-10-26T12:02:40Z","fixes":[{"ecosystem":"PyPI","package":"jupyter-server","fixed_in":["1.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jupyter-server","fixed_in":["1.0.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jupyter-server","fixed_in":["1.0.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jupyter-server","fixed_in":["1.0.7-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"jupyter-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jupyter-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jupyter-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jupyter-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"jupyter-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6"}]}],"versions":["0.0.0","0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.1.0","0.1.1","0.2.0","0.2.1","0.3.0","1.0.0","1.0.0rc0","1.0.0rc1","1.0.0rc10","1.0.0rc11","1.0.0rc12","1.0.0rc13","1.0.0rc14","1.0.0rc15","1.0.0rc16","1.0.0rc2","1.0.0rc3","1.0.0rc4","1.0.0rc5","1.0.0rc6","1.0.0rc7","1.0.0rc8","1.0.0rc9","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5"]},{"source":"osv","ecosystem":"PyPI","package":"jupyter-server","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"3d83e49090289c431da253e2bdb8dc479cbcb157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6"}]}],"versions":["0.0.0","0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.1.0","0.1.1","0.2.0","0.2.1","0.3.0","1.0.0","1.0.0rc0","1.0.0rc1","1.0.0rc10","1.0.0rc11","1.0.0rc12","1.0.0rc13","1.0.0rc14","1.0.0rc15","1.0.0rc16","1.0.0rc2","1.0.0rc3","1.0.0rc4","1.0.0rc5","1.0.0rc6","1.0.0rc7","1.0.0rc8","1.0.0rc9","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-jupyter-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-1.3"}]}],"bundled":4}],"products":[{"vendor":"jupyter","product":"jupyter_server"},{"vendor":"jupyter-server","product":"jupyter_server"}],"references":[{"url":"https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26232","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2020-234.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-grfj-wjv9-4f9v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-26232","tags":["advisory"]},{"url":"https://github.com/jupyter-server/jupyter_server","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49080","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26232","title":"Open redirect in Jupyter Server","description":"Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.","status":"published","published":"2020-11-24T21:10:14Z","modified":"2024-08-04T15:56:04.399Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:35:46.129376Z"}],"euvd":[{"id":"EUVD-2020-0090","description":"Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.","status":"published","published":"2020-11-24T21:10:14Z","modified":"2024-08-04T15:56:04Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:07:15.15938Z"}],"ghsa":[{"id":"GHSA-grfj-wjv9-4f9v","title":"Open redirect in Jupyter Server","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nOpen redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.\n\nAll jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet.\n\nThis originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh\n\n### Patches\n\n_Has the problem been patched? What versions should users upgrade to?_\n\njupyter_server 1.0.6\n\n### References\n\n[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n\n### For more information\n\nIf you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).\n\nCredit: zhuonan li of Alibaba Application Security Team","status":"published","published":"2020-11-24T21:20:52Z","modified":"2024-09-23T19:29:01Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2020-26232","description":"Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.","status":"published","published":"2020-11-24T21:15:11.557Z","modified":"2026-06-17T03:07:52.76Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"CVE-2020-26232","description":"Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.","status":"published","published":"2020-11-24T21:15:11.557Z","modified":"2026-10-20T10:52:56.092622255Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-26232","description":"Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.","status":"published","published":"2020-11-24T21:15:11.557Z","modified":"2026-10-26T12:02:40.935634998Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"GHSA-grfj-wjv9-4f9v","title":"Open redirect in Jupyter Server","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nOpen redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.\n\nAll jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet.\n\nThis originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh\n\n### Patches\n\n_Has the problem been patched? What versions should users upgrade to?_\n\njupyter_server 1.0.6\n\n### References\n\n[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n\n### For more information\n\nIf you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).\n\nCredit: zhuonan li of Alibaba Application Security Team","status":"published","published":"2020-11-24T21:20:52Z","modified":"2026-09-10T03:48:35.837724184Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"openSUSE-SU-2024:11233-1","title":"python36-jupyter-server-1.10.2-1.2 on GA media","description":"These are all security issues fixed in the python36-jupyter-server-1.10.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:46.698963Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14143-1","title":"python310-jupyter-server-2.13.0-2.2 on GA media","description":"These are all security issues fixed in the python310-jupyter-server-2.13.0-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:35:23.755973Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:12012-1","title":"python313-jupyter-server-2.20.0-1.3 on GA media","description":"These are all security issues fixed in the python313-jupyter-server-2.20.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:46.419411578Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2020-234","description":"Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.","status":"published","published":"2020-11-24T21:15:00Z","modified":"2023-11-08T04:03:15.40033Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}