DockerSpawner 13.0 has been released, which includes several fixes, most notably a security fix for validating user-requested images to launch. Upgrade via pip or conda:
pip install --upgrade dockerspawner
A security advisory will be published soon, once the updates are widely available: https://github.com/jupyterhub/dockerspawner/security/advisories/GHSA-hfgr-h3vc-p6c2 (link will work when it’s published).