CVE catalog

CVE-2024-28233

jupyterhub affected and fixed versions

JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API and user's single-user server. The affected configurations are single-origin JupyterHub deployments and JupyterHub deployments with user-controlled applications running on subdomains or peer subdomains of either the Hub or a single-user server. This vulnerability is fixed in 4.1.0.

Severity: Medium
Published: Mar 27, 2024, 7:15:48 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.33% · Oct 27, 2026

Projects and upstream resources

[python-qtconsole][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	jupyterhub	`5.0.0+ds1-1`	FixedDistribution-reported fixed boundary	[CVE-2024-28233]
Debiantrixie	jupyterhub	`5.2.1+ds1-4`	Fixed	[CVE-2024-28233]
Debiansid	jupyterhub	`5.0.0+ds1-1`	FixedDistribution-reported fixed boundary	[CVE-2024-28233]
Debiansid	jupyterhub	`5.2.1+ds1-5`	Fixed	[CVE-2024-28233]
Debianforky	jupyterhub	`5.0.0+ds1-1`	FixedDistribution-reported fixed boundary	[CVE-2024-28233]
Debianforky	jupyterhub	`5.2.1+ds1-5`	Fixed	[CVE-2024-28233]

Showing 6 fix observations. All 9 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	jupyterhub	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	jupyterhub	Not reported	AffectedDistribution reports no fix	[CVE-2024-28233]
Debianbookworm	jupyterhub	`3.0.0+ds1-1`	Affected	[CVE-2024-28233]
Debianforky	jupyterhub	`5.0.0+ds1-1`	FixedDistribution-reported fixed boundary	[CVE-2024-28233]
Debianforky	jupyterhub	`5.2.1+ds1-5`	Fixed	[CVE-2024-28233]
Debiansid	jupyterhub	`5.0.0+ds1-1`	FixedDistribution-reported fixed boundary	[CVE-2024-28233]
Debiansid	jupyterhub	`5.2.1+ds1-5`	Fixed	[CVE-2024-28233]
Debiantrixie	jupyterhub	`5.0.0+ds1-1`	FixedDistribution-reported fixed boundary	[CVE-2024-28233]
Debiantrixie	jupyterhub	`5.2.1+ds1-4`	Fixed	[CVE-2024-28233]

Original provider fields

{
  "package_releases": [
    {
      "name": "jupyterhub",
      "status": "fixed",
      "release": "sid",
      "version": "5.2.1+ds1-5"
    },
    {
      "name": "jupyterhub",
      "status": "fixed",
      "release": "forky",
      "version": "5.2.1+ds1-5"
    },
    {
      "name": "jupyterhub",
      "status": "fixed",
      "release": "trixie",
      "version": "5.2.1+ds1-4"
    },
    {
      "name": "jupyterhub",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "3.0.0+ds1-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1070388,
      "name": "jupyterhub",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.0.0+ds1-1"
    },
    {
      "bug": 1070388,
      "name": "jupyterhub",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5.0.0+ds1-1"
    },
    {
      "bug": 1070388,
      "name": "jupyterhub",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.0.0+ds1-1"
    },
    {
      "bug": 1070388,
      "name": "jupyterhub",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "jupyterhub",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1070388]

Publisher notes

[bookworm] jupyterhub: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[jupyterhub]Unknown
Details (2)
- 3.0.0+ds1-1 · all · bookworm
  Affected
  dsa · jupyterhub · debian · bookworm; dsa · jupyterhub · debian · 12
- 3.0.0+ds1-1 · all · bookworm
  Affected
  dsa · jupyterhub · debian · bookworm; dsa · jupyterhub · debian · 12

[Debian 13 (Trixie)]

[jupyterhub]Unknown
Details (2)
- 5.2.1+ds1-4 · all · trixie
  Fixed · Fixed: 5.0.0+ds1-1
  dsa · jupyterhub · debian · 13
- 5.2.1+ds1-4 · all · trixie
  Fixed · Fixed: 5.0.0+ds1-1
  dsa · jupyterhub · debian · 13

Observed: Oct 28, 2026, 5:37:09 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]