GHSA-c3mw-737p-c7g2 Jupyter Server: 5xx request logging leaks token-bearing Referer header values

• PyPI jupyter_server: < 2.21.0 → fixed in 2.21.0

Summary When a request returns a 500, `jupyter_server/log.py` logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. Impact Anyone who can read the server logs can pick tokens out of these 500 entries. Tokens end up in the Referer during normal token-based login and launch flows. Affected: all versions before 2.21.0. PoC Any malformed request that returns a 500 works: ```bash curl -i -X POST \ -H 'Content-Type: application/json' \ -H 'Referer: http://127.0.0.1:8899/tree?token=REFERTOKEN' \ --data '{"name":123}' \ 'http://127.0.0.1:8899/api/kernels?token=VALIDTOKEN' ``` The log shows the token twice, once raw and once redacted: ``` "Referer": "http://127.0.0.1:8899/tree?token=REFERTOKEN", [E ... ServerApp] 500 POST /api/kernels?token=[secret] (...) referer=http://127.0.0.1:8899/tree?token=[secret] ``` Patches Fixed in 2.21.0 by 5251352. Header values are now scrubbed before the block is logged. Upgrade to 2.21.0 or later. Workarounds Limit who can read the server logs. If you can, avoid flows that put the token in the URL.