CVE-2024-28233

JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API and user's single-user server. The affected configurations are single-origin JupyterHub deployments and JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server. This vulnerability is fixed in 4.1.0.

• CWE-79
• CWE-352
• CWE-565
• CWE-79

• https://github.com/jupyterhub/jupyterhub/commit/e2798a088f5ad45340fe79cdf1386198e664f77fPatch
• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-7r3h-4ph8-w38gThird Party Advisory
• https://github.com/jupyterhub/jupyterhub/commit/e2798a088f5ad45340fe79cdf1386198e664f77fPatch
• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-7r3h-4ph8-w38gThird Party Advisory

Published

Mar 27, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28228In JetBrains YouTrack before 2024.1.25893 creation comments …5.3
• CVE-2024-28229In JetBrains YouTrack before 2024.1.25893 user without appro…6.5
• CVE-2024-2823A vulnerability has been found in DedeCMS 5.7 and classified…4.3
• CVE-2024-28230In JetBrains YouTrack before 2024.1.25893 attaching/detachin…6.5
• CVE-2024-28231eprosima Fast DDS is a C++ implementation of the Data Distri…7.5
• CVE-2024-28232Go package IceWhaleTech/CasaOS-UserService provides user man…7.5
• CVE-2024-28234Contao is an open source content management system. Starting…4.7
• CVE-2024-28235Contao is an open source content management system. Starting…6.5
• CVE-2024-28236Vela is a Pipeline Automation (CI/CD) framework built on Lin…6.5
• CVE-2024-28237OctoPrint provides a web interface for controlling consumer …4.8
• CVE-2024-28238Directus is a real-time API and App dashboard for managing S…2.3
• CVE-2024-28239Directus is a real-time API and App dashboard for managing S…4.3