Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jupyter-server | pip | <= 2.17.0 | 2.18.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, an open redirection, is explicitly described in the security advisory GHSA-qh7q-6qm3-653w. The advisory points to the LoginFormHandler._redirect_safe() method in jupyter_server/auth/login.py as the source of the issue. By comparing the git tags for the vulnerable version (2.17.0) and the patched version (2.18.0), I identified the commit 789fed081a489ff38c50ec9f6c0364cb677d4cd2 with the message "patch open redirect in /login". The diff for this commit clearly shows the addition of a code block within the _redirect_safe function. This new code specifically checks if the redirect URL starts with //, which is the technique used to exploit the open redirection vulnerability. This confirms that LoginFormHandler._redirect_safe is the vulnerable function.
