{"action":"Upgrade jupyter-server-proxy to 3.2.3 or later.","affected":[{"fixed":"4.1.1","introduced":"4.0.0"},{"fixed":"3.2.3","introduced":"0"}],"component":"jupyter-server-proxy","cve_ids":["CVE-2024-28179"],"ecosystem":"PyPI","epss":0.0103,"exploited":false,"fixed_versions":["4.1.1","3.2.3"],"ghsa_id":"GHSA-w3vc-fx9p-wp4v","id":"tcs_01M5KG1AJ8Z5JYT4HHNJ34HT3B","modified_at":"2026-06-10T17:14:18.340886644Z","published_at":"2024-03-20T15:22:02Z","references":["https://osv.dev/vulnerability/GHSA-w3vc-fx9p-wp4v","https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4v","https://nvd.nist.gov/vuln/detail/CVE-2024-28179","https://github.com/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9","https://github.com/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03","https://github.com/jupyterhub/jupyter-server-proxy","https://github.com/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.py#L433","https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2024-234.yaml"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-w3vc-fx9p-wp4v","url":"https://osv.dev/vulnerability/GHSA-w3vc-fx9p-wp4v"}],"summary":"Jupyter Server Proxy's Websocket Proxying does not require authentication"}