MEDIUM 6.1
PYSEC-2026-67
Details
Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI / jupyter-server
Introduced in:
0 Fixed in: 2.18.0 Fix
pip install --upgrade 'jupyter-server>=2.18.0'