MEDIUM6.1
PYSEC-2026-67
Quick fix
PYSEC-2026-67 — jupyter-server: upgrade to the fixed version with the command below.
pip install --upgrade 'jupyter-server>=2.18.0'Details
Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/jupyter-server
Introduced in:
0Fixed in: 2.18.0Fix
pip install --upgrade 'jupyter-server>=2.18.0'