All vulnerabilities
CVE-2025-32428GHSA-vrq4-9hc3-cgp7PYSEC-2026-365

jupyter-remote-desktop-proxy: TigerVNC accessible via the network and not just via a UNIX socket as intended

jupyterhub jupyter-remote-desktop-proxypipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.0Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.92%Chance of exploitation activity in the next 30 days, higher than 60% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in3.0.1Fixed versionGitHub
Published14 Apr 2025Updated 27 Oct 2026CVE List

What fixes it

  • 3.0.1jupyter-remote-desktop-proxy, pipGitHub
  • 3.0.1jupyter-remote-desktop-proxy, PyPIOSVpip install "jupyter-remote-desktop-proxy>=3.0.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network.

This vulnerability does not affect users having TurboVNC as the vncserver executable.

Credits

This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

Text from GitHub Advisory Database

Affected versions 4

  • jupyter-remote-desktop-proxy, pip= 3.0.0GitHub
  • jupyter-remote-desktop-proxyaffected: >= 3.0.0, < 3.0.1CVE List
  • jupyter-remote-desktop-proxy, PyPIfrom 3.0.0, fixed in 3.0.1OSV
  • jupyter-remote-desktop-proxy, PyPI3.0.0OSV

References 6