Open-source package vulnerability · PyPI

CVE-2025-32428: TigerVNC accessible via the network and not just via a UNIX socket as intended

criticalCVSS 4.0 9.0GHSA-vrq4-9hc3-cgp7

Summary jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable.

Published Apr 12, 2025 · Updated Apr 15, 2025

Affected packages

jupyter-remote-desktop-proxy

Ecosystem: PyPI
Affected: = 3.0.0
Fixed in: 3.0.1
Check: pip show jupyter-remote-desktop-proxy

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network.

This vulnerability does not affect users having TurboVNC as the vncserver executable.

Credits

This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

Credited to frejanordsiek, consideRatio, minrk.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology