{"id":"CVE-2025-32428","aliases":["GHSA-vrq4-9hc3-cgp7","PYSEC-2026-365"],"title":"TigerVNC accessible via the network and not just via a UNIX socket as intended","summary":"TigerVNC accessible via the network and not just via a UNIX socket as intended","severity":"critical","vendor":"jupyter-remote-desktop-proxy","product":"jupyter-remote-desktop-proxy","ecosystem":"pip","affected":["jupyter-remote-desktop-proxy >= 3.0.0, < 3.0.1"],"patched":["jupyter-remote-desktop-proxy 3.0.1"],"published":"2025-04-12","updated":"2026-10-27","sourceUpdated":"2026-10-27T17:30:38.257646497Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vrq4-9hc3-cgp7","references":[{"url":"https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32428"},{"url":"https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d"},{"url":"https://github.com/jupyterhub/jupyter-remote-desktop-proxy"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-remote-desktop-proxy/PYSEC-2026-365.yaml"},{"url":"https://pypi.org/project/jupyter-remote-desktop-proxy"},{"url":"https://github.com/advisories/GHSA-vrq4-9hc3-cgp7"}],"tags":["osv","pip","ghsa"],"epss":0.00916,"epssPercentile":0.60001,"cwe":["CWE-668"],"ingestedAt":"2026-10-27T17:33:23.770Z","slug":"CVE-2025-32428","body":"## Overview\n\n## Summary\n\n`jupyter-remote-desktop-proxy` was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by `jupyter-remote-desktop-proxy` were still accessible via the network.\n\nThis vulnerability does not affect users having TurboVNC as the `vncserver` executable.\n\n## Credits\n\nThis vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.\n\n## Affected packages\n\n- `jupyter-remote-desktop-proxy >= 3.0.0, < 3.0.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jupyter-remote-desktop-proxy 3.0.1`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":52.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}