Threats tagged 'ghsa-24qx-w28j-9m6p'

Jupyter Server versions 2.17.0 and earlier contain a vulnerability in the Origin header validation logic. The server uses Python's re.match() function with a pattern that is not fully anchored, allowing origins that start with a trusted domain but have additional characters appended to bypass CORS restrictions. This enables an attacker controlling such a domain to make unauthorized cross-origin requests to the Jupyter Server API. The issue is fixed in version 2.18.0.