CVE-2025-61669
Fixed in a distro release EPSS <1%CVSS 6.3
Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
Products: jupyter-server jupyter_server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | jupyter-server | 2.18.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | datahub-ingestion | 1.5.0.4-r0 |
| Chainguard | datahub-ingestion-fips | 1.5.0.1-r2 |
| Debian 12 | jupyter-server | no fix |
| Debian 13 | jupyter-server | no fix |
| Debian 14 | jupyter-server | 2.20.0-1 |
| Ubuntu 22.04 LTS | jupyter-server | no fix |
| Ubuntu 24.04 LTS | jupyter-server | no fix |
| Ubuntu 25.10 | jupyter-server | no fix |
| Ubuntu 26.04 LTS | jupyter-server | no fix |
| Ubuntu 26.10 | jupyter-server | no fix |
| openSUSE Tumbleweed | python-jupyter-server | 2.18.1-1.1 |