Listen to this Post
The vulnerability is a chain of an open redirect and a stored XSS within the Dask dashboard’s error page handler. When `jupyter-server-proxy` is enabled in Jupyter Lab, it proxies requests to the Dask dashboard running on localhost. A specifically crafted URL containing JavaScript within the path component can be sent to a user. When clicked, this malicious URL routes through the Jupyter proxy to the Dask dashboard’s error page endpoint. The dashboard unsafely reflects the path of the failed request directly into the HTML of the error page without proper sanitization. This injected JavaScript is then rendered and executed in the victim’s browser session. Since the browser is already authenticated to the Jupyter Lab instance, the JavaScript code can subsequently make authenticated requests to the Jupyter Lab API. This allows it to execute arbitrary code within the user’s Jupyter kernel by forging requests to the kernel’s execution endpoint, effectively turning client-side XSS into remote code execution on the Jupyter server backend.
Platform: Dask distributed
Version: < 2026.1.1
Vulnerability: XSS via proxy
Severity: Critical
date: 2026-01-17
Prediction: 2026.01.31
What Undercode Say:
Typical vulnerable setup commands
jupyter labextension install @jupyterlab/server-proxy
jupyter lab --port 8888
dask scheduler --port 8787
dask worker localhost:8787
Example malicious URL structure (conceptual)
http://localhost:8888/proxy/8787/status/<script>fetch('http://localhost:8888/api/kernels/.../execute',{method:'POST',body:'{"code":"import os;os.system(\"touch /tmp/pwned\")"}'})</script>
How Exploit:
1. Attacker crafts phishing URL.
2. User clicks, loading Dask error page.
3. Script executes in browser context.
4. Script calls Jupyter kernel API.
5. Arbitrary code runs on server.
Protection from this CVE:
- Upgrade to 2026.1.1.
- Remove jupyter-server-proxy.
- Use non-default ports.
Impact:
- Arbitrary code execution.
- Kernel compromise.
- Data theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
