CVE-2020-26232

Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.

• CWE-601

• https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18Release Notes, Third Party Advisory
• https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157Patch, Third Party Advisory
• https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9vThird Party Advisory
• https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18Release Notes, Third Party Advisory
• https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157Patch, Third Party Advisory
• https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9vThird Party Advisory

Published

Nov 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26227TYPO3 is an open source PHP based web content management sys…6.1
• CVE-2020-26228TYPO3 is an open source PHP based web content management sys…7.5
• CVE-2020-26229TYPO3 is an open source PHP based web content management sys…3.7
• CVE-2020-2623Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26230Radar COVID is the official COVID-19 exposure notification a…5.3
• CVE-2020-26231October is a free, open-source, self-hosted CMS platform bas…6.7
• CVE-2020-26233Git Credential Manager Core (GCM Core) is a secure Git crede…7.3
• CVE-2020-26234Opencast before versions 8.9 and 7.9 disables HTTPS hostname…4.8
• CVE-2020-26235In Rust time crate from version 0.2.7 and before version 0.2…5.3
• CVE-2020-26236In ScratchVerifier before commit a603769, an attacker can hi…7.5
• CVE-2020-26237Highlight.js is a syntax highlighter written in JavaScript. …8.7
• CVE-2020-26238Cron-utils is a Java library to parse, validate, migrate cro…8.1