CVE-2025-32428
Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended
Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable. This issue is fixed in 3.0.1.
Reserved 2025-04-08 | Published 2025-04-14 | Updated 2025-04-15 | Assigner GitHub_MCWE-668: Exposure of Resource to Wrong Sphere
github.com/...-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7
github.com/...ommit/7dd54c25a4253badd8ea68895437e5a66a59090d
Support options
