AIKIDO-2026-11088
jupyter-server is vulnerable to Origin Validation Error
61
Medium Risk
This Affects:
jupyter-serverTL;DR
jupyter-server validates allow_origin_pat with prefix-style regular expression matching. A malicious origin that begins with a trusted domain can pass checks intended for only that trusted origin. The bypass affects CORS headers, WebSocket origin checks, referer validation, and login redirects when this configuration is used. The fix switches origin validation to full-string matching and adds tests for bypass origins.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
jupyter-server is vulnerable to Origin Validation Error in versions 1.12.0 - 2.17.0.
How to fix this
Upgrade the jupyter-server library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant