CVE-2020-26275 json
Open redirect vulnerability
published 2020-12-21 5 y ago modified 2026-07-09 4 mo ago also GHSA-9f66-54xg-pc2c , PYSEC-2020-346 , PYSEC-2020-50 , EUVD-2020-0091
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: "jupyter server --ServerApp.base_url=/jupyter/".
Patch / fix
- pypi jupyter-server 1.1.1
- jupyter jupyter_server 1.1.1
- jupyter-server Debian 14, Debian 13, Debian 12 1.1.1-1
debian advisories DEBIAN-CVE-2020-26275
Exploit prediction
1.37% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- advisory.checkmarx.net https://advisory.checkmarx.net/advisory/CX-2020-4291 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | jupyter-server | <1.1.1 |
1.1.1 |
Affected products
- jupyter-server jupyter_server
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/jupyter-server/jupyter_server/commit/85e4abccf6ea9321d29153f73b0bd72ccb3a6bca
web, patch, third-party-advisory
-
github.com
/jupyter-server/jupyter_server/security/advisories/GHSA-9f66-54xg-pc2c
web, patch, third-party-advisory, advisory
-
advisory.checkmarx.net
/advisory/CX-2020-4291
web, exploit, third-party-advisory, advisory, evidence
-
pypi.org
/project/jupyter-server/
product, package
-
nvd.nist.gov
/vuln/detail/CVE-2020-26275
advisory
-
github.com
/jupyter-server/jupyter_server
package
-
github.com
/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2020-346.yaml
web
-
github.com
/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2020-50.yaml
web
-
pypi.org
/project/jupyter-server
web
Sources
- CVE List CVE-2020-26275
- GitHub Advisory GHSA-9f66-54xg-pc2c
- NVD CVE-2020-26275
- OSV PYSEC-2020-50
- OSV PYSEC-2020-346
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.