-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows critical modifications to _redirect_safe in login.py. The original code only checked parsed.netloc, while the patched version adds checks for parsed.scheme and modifies URL normalization. The vulnerability allowed crafted URLs with schemes but empty netloc (e.g., 'https:///evil.com') to bypass redirect restrictions. The added test case 'https:///a%40b/extra/slash' in test_login.py demonstrates the attack vector. The function's role in processing redirect URLs and the specific validation logic changes confirm its vulnerability to CWE-601.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jupyter-server | pip | < 2.7.2 | 2.7.2 |
PythonPythonOngoing coverage of React2Shell