---
id: CVE-2025-32428
aliases:
  - GHSA-vrq4-9hc3-cgp7
  - PYSEC-2026-365
title: TigerVNC accessible via the network and not just via a UNIX socket as intended
summary: TigerVNC accessible via the network and not just via a UNIX socket as intended
severity: critical
vendor: jupyter-remote-desktop-proxy
product: jupyter-remote-desktop-proxy
ecosystem: pip
affected:
  - 'jupyter-remote-desktop-proxy >= 3.0.0, < 3.0.1'
patched:
  - jupyter-remote-desktop-proxy 3.0.1
published: '2025-04-12'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T17:30:38.257646497Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vrq4-9hc3-cgp7'
references:
  - url: >-
      https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-32428'
  - url: >-
      https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d
  - url: 'https://github.com/jupyterhub/jupyter-remote-desktop-proxy'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-remote-desktop-proxy/PYSEC-2026-365.yaml
  - url: 'https://pypi.org/project/jupyter-remote-desktop-proxy'
  - url: 'https://github.com/advisories/GHSA-vrq4-9hc3-cgp7'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00916
epssPercentile: 0.60001
cwe:
  - CWE-668
ingestedAt: '2026-10-27T17:33:23.770Z'
---

## Overview

## Summary

`jupyter-remote-desktop-proxy` was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by `jupyter-remote-desktop-proxy` were still accessible via the network.

This vulnerability does not affect users having TurboVNC as the `vncserver` executable.

## Credits

This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

## Affected packages

- `jupyter-remote-desktop-proxy >= 3.0.0, < 3.0.1`

## Remediation

Upgrade to a patched release:

- `jupyter-remote-desktop-proxy 3.0.1`