CVE-2019-10255: Open Redirect Vulnerability in JupyterHub and Notebook
Summary
CVE-2019-10255: Open Redirect vulnerability in jupyterhub and notebook. Affects notebook versions < 5.7.8. Fixed in 5.7.8. How to fix ↓
Also tracked for
- jupyterhub · PyPI
- jupyter-notebook · Debian:11
The same CVE-2019-10255 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JupyterHub and Notebook are popular open-source tools used for interactive computing and data science workflows. JupyterHub allows multiple users to access Jupyter Notebook instances, while Jupyter Notebook provides an interactive environment for creating and sharing documents containing live code, equations, visualizations, and narrative text. These tools are widely used in educational, research, and industry settings.
Vulnerability Detail
The identified vulnerability, CVE-2019-10255, is an Open Redirect vulnerability that affects JupyterHub versions prior to 0.9.6 and Jupyter Notebook versions prior to 5.7.8. This vulnerability allows an attacker to craft malicious links that, when clicked by a user, redirect them to a malicious website after successful login. The vulnerability primarily affects Chrome and Firefox browsers in JupyterHub, while all browsers are vulnerable in Jupyter Notebook. Servers running on a base_url prefix are not affected.
How To Fix
Latest published version: 7.6.3 as of 22 Oct 2026
pip install --upgrade "notebook==7.6.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.7.8
This is the first release that contains the fix.
pip install --upgrade "notebook==5.7.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest versions is not immediately feasible, users can implement a workaround by manually validating and sanitizing any URLs used for redirection. This can be done by ensuring that the redirect URLs are limited to trusted domains or by implementing a whitelist of allowed redirect URLs. It is important to carefully review and test any custom code or configurations related to URL redirection to ensure they do not introduce additional security risks.
Conclusion
The Open Redirect vulnerability in JupyterHub and Notebook (CVE-2019-10255) poses a moderate security risk. It allows attackers to redirect users to malicious websites after successful login. To mitigate this vulnerability, it is crucial to update JupyterHub to version 0.9.6 or later and Jupyter Notebook to version 5.7.8 or later. Alternatively, implementing URL validation and sanitization can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for notebook →
FAQ
An Open Redirect vulnerability occurs when a web application allows external input to control the destination of a redirect. Attackers can exploit this vulnerability by crafting malicious links that appear legitimate but redirect users to malicious websites after successful login.
In JupyterHub, the vulnerability affects Chrome and Firefox browsers. In Jupyter Notebook, all browsers are vulnerable.
No, servers running on a base_url prefix are not affected by this vulnerability.
To check the version of JupyterHub, you can run the command 'jupyterhub --version' in your terminal. For Jupyter Notebook, you can run 'jupyter notebook --version'.
There is no information available regarding known exploits or active attacks leveraging this vulnerability at the time of this report. However, it is always recommended to promptly apply security updates to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for notebook.
