Critical

TigerVNC accessible via the network and not just via a UNIX socket as intended

Disclosed: 12.04.2025
Updated: 11.10.2026 12:20

Summary

jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network.

This vulnerability does not affect users having TurboVNC as the vncserver executable.

Credits

This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	jupyter-remote-desktop-proxy	>= 3.0.0, < 3.0.1	3.0.1

References

CVSS score -

CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness (CWE): CWE-668
Platform: Python (PyPI)
Package: jupyter-remote-desktop-proxy
Disclosed: 12.04.2025
Updated: 11.10.2026 12:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-vrq4-9hc3-cgp7 - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-365 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: jupyter-remote-desktop-proxy

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

This is the only known vulnerability of this package.

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application