# Security

**URL:** https://discourse.jupyter.org/c/special-topics/security/48.md

[Latest](https://discourse.jupyter.org/latest.md) · [Categories](https://discourse.jupyter.org/categories.md) · [Tags](https://discourse.jupyter.org/tags.md)

---

## [About the Security category](https://discourse.jupyter.org/t/about-the-security-category/9319)

<div class="topic-metadata">

**Author:** [@choldgraf](https://discourse.jupyter.org/u/choldgraf)\
**Replies:** 5\
**Last updated:** [August 26, 2022, 11:39pm UTC](https://discourse.jupyter.org/t/about-the-security-category/9319 "2022-08-26T23:39:09Z")

</div>

Discuss security-related topics in the Jupyter ecosystem.

---

## [Security advisory in jupyterlab-git (CVE-2025-30370)](https://discourse.jupyter.org/t/security-advisory-in-jupyterlab-git-cve-2025-30370/34402)

<div class="topic-metadata">

**Author:** [@krassowski](https://discourse.jupyter.org/u/krassowski)\
**Replies:** 0\
**Last updated:** [April 8, 2025, 8:28am UTC](https://discourse.jupyter.org/t/security-advisory-in-jupyterlab-git-cve-2025-30370/34402 "2025-04-08T08:28:42Z")

</div>

See

---

## [How to conduct notebook level access control for users?](https://discourse.jupyter.org/t/how-to-conduct-notebook-level-access-control-for-users/33310)

<div class="topic-metadata">

**Author:** [@zjia](https://discourse.jupyter.org/u/zjia)\
**Replies:** 0\
**Last updated:** [February 27, 2025, 9:08pm UTC](https://discourse.jupyter.org/t/how-to-conduct-notebook-level-access-control-for-users/33310 "2025-02-27T21:08:06Z")

</div>

I would like to make a role based access control for specific notebooks. I read this doc Security in the Jupyter Server — Jupyter Server documentation. I tried to customize the jupyter\_server.auth.Authorizer. However, i…

---

## [Advisory on JupyterLab and Notebook 7](https://discourse.jupyter.org/t/advisory-on-jupyterlab-and-notebook-7/27939)

<div class="topic-metadata">

**Author:** [@krassowski](https://discourse.jupyter.org/u/krassowski)\
**Replies:** 0\
**Last updated:** [August 28, 2024, 5:39pm UTC](https://discourse.jupyter.org/t/advisory-on-jupyterlab-and-notebook-7/27939 "2024-08-28T17:39:15Z")

</div>

We just published HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering · Advisory · jupyterlab/jupyterlab · GitHub Impact The vulnerability depends on user interaction by opening a malicious note…

---

## [Security update for extensions authors using GitHub Actions (CVE-2024-39700)](https://discourse.jupyter.org/t/security-update-for-extensions-authors-using-github-actions-cve-2024-39700/26990)

<div class="topic-metadata">

**Author:** [@krassowski](https://discourse.jupyter.org/u/krassowski)\
**Replies:** 0\
**Last updated:** [July 16, 2024, 9:37am UTC](https://discourse.jupyter.org/t/security-update-for-extensions-authors-using-github-actions-cve-2024-39700/26990 "2024-07-16T09:37:33Z")

</div>

For attention of extension authors using extensions seeded from template/cookiecutter-ts in a public GitHub repository - a potential RCE vulnerability in galata update workflow was identified (CVE-2024-39700) and we reco…

---

## [Voila 0.2.17, 0.3.8, 0.4.4, 0.5.6 security update out (CVE-2024-30265)](https://discourse.jupyter.org/t/voila-0-2-17-0-3-8-0-4-4-0-5-6-security-update-out-cve-2024-30265/24960)

<div class="topic-metadata">

**Author:** [@martinRenou](https://discourse.jupyter.org/u/martinRenou)\
**Replies:** 1\
**Last updated:** [April 22, 2024, 6:37am UTC](https://discourse.jupyter.org/t/voila-0-2-17-0-3-8-0-4-4-0-5-6-security-update-out-cve-2024-30265/24960 "2024-04-22T06:37:38Z")

</div>

4 releases of Voila that fix an issue allowing users to access any file on the server. CVE-2024-30265 This security breach should only affect users of the voila CLI, if voila is used as a server extension you should be …

---

## [Three security advisories for JupyterLab and Notebook](https://discourse.jupyter.org/t/three-security-advisories-for-jupyterlab-and-notebook/23530)

<div class="topic-metadata">

**Author:** [@krassowski](https://discourse.jupyter.org/u/krassowski)\
**Replies:** 0\
**Last updated:** [January 20, 2024, 2:02pm UTC](https://discourse.jupyter.org/t/three-security-advisories-for-jupyterlab-and-notebook/23530 "2024-01-20T14:02:25Z")

</div>

This week a series of vulnerabilities was addressed in the Jupyter packages: jupyter-lsp 2.2.2 was released including a fix for critical security vulnerability GHSA-4qhp-652w-c22x; all users of JupyterLab v4.0 and Noteb…

---

## [Jupyter Security Subproject Meetings](https://discourse.jupyter.org/t/jupyter-security-subproject-meetings/10615)

<div class="topic-metadata">

**Author:** [@rcthomas](https://discourse.jupyter.org/u/rcthomas)\
**Replies:** 5\
**Last updated:** [May 24, 2023, 5:19pm UTC](https://discourse.jupyter.org/t/jupyter-security-subproject-meetings/10615 "2023-05-24T17:19:18Z")

</div>

Hi everyone, I wanted to announce the third biweekly Jupyter Security Meeting will be happening next week on Friday (September 10, 2021) at 9 AM PDT. The biweekly meetings are listed on the Jupyter community calendar. T…

---

## [How to restrict jupyterhub login redirect url](https://discourse.jupyter.org/t/how-to-restrict-jupyterhub-login-redirect-url/18209)

<div class="topic-metadata">

**Author:** [@qimingg](https://discourse.jupyter.org/u/qimingg)\
**Replies:** 1\
**Last updated:** [March 2, 2023, 11:38pm UTC](https://discourse.jupyter.org/t/how-to-restrict-jupyterhub-login-redirect-url/18209 "2023-03-02T23:38:17Z")

</div>

Hi! Our security team finds that the browser can redirect to any URL without restriction using the ‘next param’ when login hub. For example, if I request such URL: http://xxx.xxx.com/jupyterhub/hub/login?access\_token=x…

---

## [Security Advisory for Jupyter Core package](https://discourse.jupyter.org/t/security-advisory-for-jupyter-core-package/16527)

<div class="topic-metadata">

**Author:** [@blink1073](https://discourse.jupyter.org/u/blink1073)\
**Replies:** 0\
**Last updated:** [October 26, 2022, 7:06pm UTC](https://discourse.jupyter.org/t/security-advisory-for-jupyter-core-package/16527 "2022-10-26T19:06:32Z")

</div>

We just published a security advisory to jupyter\_core. Users are recommended to upgrade to jupyter\_core\>=4.11.2 to pick up the fix, which prevents Jupyter applications from loading configuration files from the current w…

---

## [Connecting to Spark Cluster with all-spark-notebook](https://discourse.jupyter.org/t/connecting-to-spark-cluster-with-all-spark-notebook/14911)

<div class="topic-metadata">

**Author:** [@ltm893](https://discourse.jupyter.org/u/ltm893)\
**Replies:** 0\
**Last updated:** [July 12, 2022, 10:55pm UTC](https://discourse.jupyter.org/t/connecting-to-spark-cluster-with-all-spark-notebook/14911 "2022-07-12T22:55:25Z")

</div>

I am trying to setup an SSL connection between a docker all-spark-notebook and Spark Cluster. I was given a .crt file. Tried putting it in here /etc/ssl/certs but dont think that worked.

---

## [Requiring 2FA for Jupyter GitHub Organizations](https://discourse.jupyter.org/t/requiring-2fa-for-jupyter-github-organizations/14836)

<div class="topic-metadata">

**Author:** [@rpwagner](https://discourse.jupyter.org/u/rpwagner)\
**Replies:** 0\
**Last updated:** [July 5, 2022, 3:18pm UTC](https://discourse.jupyter.org/t/requiring-2fa-for-jupyter-github-organizations/14836 "2022-07-05T15:18:29Z")

</div>

Requiring 2FA for Jupyter GitHub Organizations This requirement and the outlined plan was discussed and agreed upon at the Jupyter Governance meeting on Friday, July 1, 2022. This was also posted on the Jupyter Blog. By…

---

## [\[ANN\] Security Releases for Jupyter Server and Notebook](https://discourse.jupyter.org/t/ann-security-releases-for-jupyter-server-and-notebook/14591)

<div class="topic-metadata">

**Author:** [@blink1073](https://discourse.jupyter.org/u/blink1073)\
**Replies:** 0\
**Last updated:** [June 14, 2022, 3:53pm UTC](https://discourse.jupyter.org/t/ann-security-releases-for-jupyter-server-and-notebook/14591 "2022-06-14T15:53:02Z")

</div>

Hi all, We have published security releases of both Jupyter Server and Notebook packages, both of moderate severity. Please update to Jupyter Server 1.17.1+ and/or Notebook 6.4.12+. For more information, see the publi…

---

## [Security vulnerability handling document](https://discourse.jupyter.org/t/security-vulnerability-handling-document/13848)

<div class="topic-metadata">

**Author:** [@rcthomas](https://discourse.jupyter.org/u/rcthomas)\
**Replies:** 0\
**Last updated:** [April 12, 2022, 3:43pm UTC](https://discourse.jupyter.org/t/security-vulnerability-handling-document/13848 "2022-04-12T15:43:36Z")

</div>

The Jupyter Security subproject is creating a new document that describes the process of coordinating responses to security vulnerabilities reported to the Jupyter project. We want to invite everyone interested in any a…

---

## [Security Advisory for Jupyter Server and Notebook packages](https://discourse.jupyter.org/t/security-advisory-for-jupyter-server-and-notebook-packages/13547)

<div class="topic-metadata">

**Author:** [@Zsailer](https://discourse.jupyter.org/u/Zsailer)\
**Replies:** 0\
**Last updated:** [March 22, 2022, 9:46pm UTC](https://discourse.jupyter.org/t/security-advisory-for-jupyter-server-and-notebook-packages/13547 "2022-03-22T21:46:54Z")

</div>

We just published Security Advisories to the jupyter\_server and notebook repos. Please upgrade to jupyter\_server\>=1.15.4 and notebook\>=6.4.10.

---

## [Jupyter Security-Related Documentation](https://discourse.jupyter.org/t/jupyter-security-related-documentation/10921)

<div class="topic-metadata">

**Author:** [@rpwagner](https://discourse.jupyter.org/u/rpwagner)\
**Replies:** 2\
**Last updated:** [November 5, 2021, 5:53am UTC](https://discourse.jupyter.org/t/jupyter-security-related-documentation/10921 "2021-11-05T05:53:44Z")

</div>

Hi, As part of the Trusted CI engagement on Jupyter security, the Trusted CI staff have compiled a list of pages describing security-related Jupyter documentation. The list is in a Google Doc that is open to public comm…

---

## [Protecting IP of webapps](https://discourse.jupyter.org/t/protecting-ip-of-webapps/10328)

<div class="topic-metadata">

**Author:** [@PrerakDongaonkar03](https://discourse.jupyter.org/u/PrerakDongaonkar03)\
**Replies:** 2\
**Last updated:** [August 20, 2021, 2:42am UTC](https://discourse.jupyter.org/t/protecting-ip-of-webapps/10328 "2021-08-20T02:42:33Z")

</div>

Big thanks to all the developers in the Jupyter Community for enabling this entire environment. I have been developing web apps for some time now, and I really want to learn how we can protect the IP of web apps and then…

---

## [Project Jupyter Security Subproject](https://discourse.jupyter.org/t/project-jupyter-security-subproject/10175)

<div class="topic-metadata">

**Author:** [@afshin](https://discourse.jupyter.org/u/afshin)\
**Replies:** 11\
**Last updated:** [August 12, 2021, 3:13am UTC](https://discourse.jupyter.org/t/project-jupyter-security-subproject/10175 "2021-08-12T03:13:08Z")

</div>

Hi everyone! We’d like to announce the formation of a new Jupyter Subproject to manage and handle the different security-related aspects of the project. The group’s team compass will reside here: GitHub - jupyter/securit…

---

## [How do I properly protect my data access passwords (not jupyter tokens/passwords) on 3rd party jupyter hub services?](https://discourse.jupyter.org/t/how-do-i-properly-protect-my-data-access-passwords-not-jupyter-tokens-passwords-on-3rd-party-jupyter-hub-services/9277)

<div class="topic-metadata">

**Author:** [@christine-e-smit](https://discourse.jupyter.org/u/christine-e-smit)\
**Replies:** 3\
**Last updated:** [June 1, 2021, 8:09pm UTC](https://discourse.jupyter.org/t/how-do-i-properly-protect-my-data-access-passwords-not-jupyter-tokens-passwords-on-3rd-party-jupyter-hub-services/9277 "2021-06-01T20:09:52Z")

</div>

I have a security question: how do I protect my data access passwords in jupyterhub? Here is my scenario: I’m using a third-party jupyterhub service. Maybe this is through my University. Maybe this is through a 3rd par…

---

## [Jupyter Security Workshop Progress](https://discourse.jupyter.org/t/jupyter-security-workshop-progress/9370)

<div class="topic-metadata">

**Author:** [@rpwagner](https://discourse.jupyter.org/u/rpwagner)\
**Replies:** 0\
**Last updated:** [May 28, 2021, 8:06pm UTC](https://discourse.jupyter.org/t/jupyter-security-workshop-progress/9370 "2021-05-28T20:06:23Z")

</div>

@rcthomas and I wanted to share an update on our activities related to the Jupyter Security Best Practices Workshop. We’ve restarted our planning for this after a natural pause. The target date for the in-person worksh…

---

## [Embedding codepens](https://discourse.jupyter.org/t/embedding-codepens/8011)

<div class="topic-metadata">

**Author:** [@parmentelat](https://discourse.jupyter.org/u/parmentelat)\
**Replies:** 0\
**Last updated:** [February 18, 2021, 6:50pm UTC](https://discourse.jupyter.org/t/embedding-codepens/8011 "2021-02-18T18:50:00Z")

</div>

Hi; a couple years back I wrote a IPython magic to allow me to embed pythontutor visualizations I’m currently trying to do something similar with codepen; to no avail so far outside of the notebook, the logic is rather…

---

## [Potential security issue?](https://discourse.jupyter.org/t/potential-security-issue/6756)

<div class="topic-metadata">

**Author:** [@goose](https://discourse.jupyter.org/u/goose)\
**Replies:** 7\
**Last updated:** [November 16, 2020, 7:13pm UTC](https://discourse.jupyter.org/t/potential-security-issue/6756 "2020-11-16T19:13:27Z")

</div>

I offer jupyter notebook instances to users. The instances are setup so that a random token is generated, and the user receive a url containing the token (eg. http://35.12.23.24:8888/?token=fdeb28d49186887fd091e24092853…

---

## [Does switching to a new authenticator on JupyterHub on Kubernetes (Zero-to-JupyterHub-k8s) delete all the old users?](https://discourse.jupyter.org/t/does-switching-to-a-new-authenticator-on-jupyterhub-on-kubernetes-zero-to-jupyterhub-k8s-delete-all-the-old-users/6608)

<div class="topic-metadata">

**Author:** [@Jaya\_Venkatesh](https://discourse.jupyter.org/u/Jaya_Venkatesh)\
**Replies:** 3\
**Last updated:** [November 4, 2020, 9:00pm UTC](https://discourse.jupyter.org/t/does-switching-to-a-new-authenticator-on-jupyterhub-on-kubernetes-zero-to-jupyterhub-k8s-delete-all-the-old-users/6608 "2020-11-04T21:00:42Z")

</div>

Hi, I currently have a cluster running on AWS with Zero-to-JupyterHub-k8s installed on it. Currently the hub is not using any authentication and I want to start using the Native Authenticator. By doing this, will I lose …

---

## [JupyterHub traffic flows + how they are secured](https://discourse.jupyter.org/t/jupyterhub-traffic-flows-how-they-are-secured/1246)

<div class="topic-metadata">

**Author:** [@yuvipanda](https://discourse.jupyter.org/u/yuvipanda)\
**Replies:** 4\
**Last updated:** [October 8, 2020, 9:22am UTC](https://discourse.jupyter.org/t/jupyterhub-traffic-flows-how-they-are-secured/1246 "2020-10-08T09:22:11Z")

</div>

Heya! I’ve been doodling a lot recently, and spent this morning making a diagram of: The primary components of JupyterHub How they communicate with each other How various security components - authentication, authoriza…

---

## [Security advisory for JupyterHub deployments on Kubernetes with named servers enabled](https://discourse.jupyter.org/t/security-advisory-for-jupyterhub-deployments-on-kubernetes-with-named-servers-enabled/5257)

<div class="topic-metadata">

**Author:** [@minrk](https://discourse.jupyter.org/u/minrk)\
**Replies:** 0\
**Last updated:** [July 17, 2020, 1:34pm UTC](https://discourse.jupyter.org/t/security-advisory-for-jupyterhub-deployments-on-kubernetes-with-named-servers-enabled/5257 "2020-07-17T13:34:10Z")

</div>

We have just published a security advisory that affects JupyterHub deployments on kubernetes which have enabled allowNamedServers: true, where collisions could occur between the default server of certain usernames that r…

---

## [Jupyter Security Best Practices Workshop](https://discourse.jupyter.org/t/jupyter-security-best-practices-workshop/1496)

<div class="topic-metadata">

**Author:** [@rpwagner](https://discourse.jupyter.org/u/rpwagner)\
**Replies:** 12\
**Last updated:** [February 18, 2020, 12:53am UTC](https://discourse.jupyter.org/t/jupyter-security-best-practices-workshop/1496 "2020-02-18T00:53:08Z")

</div>

This is a continuation of an initial discussion on the Jupyter Security mailing list to evaluate the interest in a workshop focused on security in for Jupyter. Based on the response in the mailing list, it’s clear that t…

---

## [Co-author a blog post on z2jh security with me?](https://discourse.jupyter.org/t/co-author-a-blog-post-on-z2jh-security-with-me/2404)

<div class="topic-metadata">

**Author:** [@yuvipanda](https://discourse.jupyter.org/u/yuvipanda)\
**Replies:** 0\
**Last updated:** [October 15, 2019, 3:07am UTC](https://discourse.jupyter.org/t/co-author-a-blog-post-on-z2jh-security-with-me/2404 "2019-10-15T03:07:18Z")

</div>

Hello! Similar to me 99 ways to extend the Jupyter ecosystem blog post, I’m now trying to write a detailed deep dive into the security aspects of Zero to JupyterHub for the Jupyter Blog. It is informed by working with p…

---

## [Security Audit of Jupyter Notebook](https://discourse.jupyter.org/t/security-audit-of-jupyter-notebook/840)

<div class="topic-metadata">

**Author:** [@yuvipanda](https://discourse.jupyter.org/u/yuvipanda)\
**Replies:** 4\
**Last updated:** [April 24, 2019, 5:04am UTC](https://discourse.jupyter.org/t/security-audit-of-jupyter-notebook/840 "2019-04-24T05:04:56Z")

</div>

A lot of places use Jupyter Notebook (and JupyterHub) to work with private data where security compromises would have serious implications. We have a pretty good track record with security (:heart::heart::heart: to every…