AIKIDO-2026-507994
jupyterhub is vulnerable to Cross-Site Scripting (XSS)
87
High Risk
This Affects:
jupyterhubTL;DR
The share-invitation and related login templates render URL values such as the invitation next_url and spawner_url through the Jinja safe filter, so their contents are emitted into the page without HTML escaping. A user permitted to create sharing invitations can craft a link whose URL values contain markup that is reflected into the /hub/accept-share page when an authorized user opens it. Before the fix this allows script to run in the victim's authenticated browser session. The fix removes the safe filter so these URL values are HTML-escaped.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have user-initiated sharing enabled so that the users:shares scope is granted to users.
Background info
jupyterhub is vulnerable to Cross-Site Scripting (XSS) in versions 5.0.0 - 5.5.0.
How to fix this
Upgrade the jupyterhub library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant