GHSA-gcv9-6737-pjqw SSRF vulnerability in jupyter-server-proxy

• PyPI jupyter-server-proxy: < 3.2.1 → fixed in 3.2.1

Impact What kind of vulnerability is it? Server-Side Request Forgery ( SSRF ) Who is impacted? Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled. A lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Patches _Has the problem been patched? What versions should users upgrade to?_ Upgrade to 3.2.1, or apply the patch https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch For more information If you have any questions or comments about this advisory: • Open a topic on our forum • Email the Jupyter security team at [email protected]