CVE-2025-32428 - CVE House
Back to Database
Status published Critical CVE-2025-32428

Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended

Vulnerability Description

Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable. This issue is fixed in 3.0.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32428

Credits & Attribution

No credits recorded in the NVD database.

References

More from jupyterhub

View All →
CVE-2024-41942
JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
High 7.2
CVE-2024-37300
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
High 8.1
CVE-2024-35225
Jupyter Server Proxy has a reflected XSS issue in host parameter
Critical 9.7
CVE-2024-29033
GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace
High 7.5
CVE-2024-28233
XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
High 8.1

Affected Vendor

Affected Software

jupyter-remote-desktop-proxy
Vulnerable Versions:
>= 3.0.0, < 3.0.1

Timeline

Official Publish: April 14th, 2025
Last Modified: April 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-668

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence