~ / search / GHSA-vrq4-9hc3-cgp7

GHSA-vrq4-9hc3-cgp7

TigerVNC accessible via the network and not just via a UNIX socket as intended

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-32428

Packages

EcosystemPackageAffectedFixed in
PyPI jupyter-remote-desktop-proxy >= 3.0.0, < 3.0.1 3.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary `jupyter-remote-desktop-proxy` was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by `jupyter-remote-desktop-proxy` were still accessible via the network. This vulnerability does not affect users having TurboVNC as the `vncserver` executable. ## Credits This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

References

External links from the advisory. They lead to third-party sites.