Critical severity · published Apr 14, 2025
CVE-2025-32428
Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended
9.0
CVSS
0.9%
EPSS
No
On KEV
Description
Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable. This issue is fixed in 3.0.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
jupyter-remote-desktop-proxy · jupyterhub
>= 3.0.0, < 3.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32428
github.com
https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d
github.com
https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7