GitHub Advisoryadvisory · PyPI

GHSA-vrq4-9hc3-cgp7 TigerVNC accessible via the network and not just via a UNIX socket as intended

CRITICAL Published 2025-04-12 Modified 2026-10-27 Official page ↗
Aliases
CVE-2025-32428
Ecosystem
PyPI
Packages
jupyter-remote-desktop-proxy
Severity
Critical
CVSS vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses
CWE-668
Reviewed
2025-04-12

Affected packages

• PyPI jupyter-remote-desktop-proxy: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

Summary `jupyter-remote-desktop-proxy` was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by `jupyter-remote-desktop-proxy` were still accessible via the network. This vulnerability does not affect users having TurboVNC as the `vncserver` executable. Credits This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

Related

Alias · CVE (1)

  • CVE-2025-32428 Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References