CVE-2023-48311

dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.

• CWE-20

• https://github.com/jupyterhub/dockerspawner/commit/3ba4b665b6ca6027ea7a032d7ca3eab977574626Patch
• https://github.com/jupyterhub/dockerspawner/security/advisories/GHSA-hfgr-h3vc-p6c2Vendor Advisory
• https://github.com/jupyterhub/dockerspawner/commit/3ba4b665b6ca6027ea7a032d7ca3eab977574626Patch
• https://github.com/jupyterhub/dockerspawner/security/advisories/GHSA-hfgr-h3vc-p6c2Vendor Advisory

Published

Dec 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48306Nextcloud Server provides data storage for Nextcloud, an ope…9.8
• CVE-2023-48307Nextcloud Mail is the mail app for Nextcloud, a self-hosted …9.8
• CVE-2023-48308Nextcloud/Cloud is a calendar app for Nextcloud. An attacker…6.5
• CVE-2023-48309NextAuth.js provides authentication for Next.js. `next-auth`…5.3
• CVE-2023-4831Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-48310TestingPlatform is a testing platform for Internet Security …7.5
• CVE-2023-48312capsule-proxy is a reverse proxy for the capsule operator pr…9.8
• CVE-2023-48313Umbraco is an ASP.NET content management system (CMS). Star…6.1
• CVE-2023-48314Collabora Online is a collaborative online office suite base…6.1
• CVE-2023-48315Azure RTOS NetX Duo is a TCP/IP network stack designed speci…9.8
• CVE-2023-48316Azure RTOS NetX Duo is a TCP/IP network stack designed speci…9.8
• CVE-2023-48317Improper Neutralization of Input During Web Page Generation …5.4