StackRadarChart IndexLive demo

CVE-2024-28233

High

Advisory

Published 28 Mar 2024In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.003; 26th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 9; of 17,781 indexed, latest versions
Container images: 14; deployed by those charts
Fix available: 1 of 1; affected package

Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing

Carried by container images the latest versions of 9 of 17,781 indexed charts deploy, on 14 images.

Affected package	Affected versions	Fixed in	Images
jupyterhubpypi	0.9.4, 1.3.0, 1.4.0, 1.5.0+4 more	4.1.0	14

OSV records: GHSA-7r3h-4ph8-w38g
Also known as: BIT-jupyterhub-2024-28233, PYSEC-2026-1480

Charts affected

9 by stars

Chart

Latest

Affected images

Radar Score

fadicetic

2 of 25 See more

fadi cetic 0.3.1

2 of the 25 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
jupyterhub/k8s-hub :0.11.1	b6b4a1a34bf0	jupyterhub@1.3.0	4.1.0
jupyterhub/k8s-singleuser-sample :0.11.1	e3e6f3051df8	jupyterhub@1.3.0	4.1.0

Open the chart page →

52,919

2 of 9 See more

daskhub dask 2024.1.1

2 of the 9 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
pangeo/base-notebook :2024.01.15	5fbe688a4f80	jupyterhub@4.0.2	4.1.0
quay.io/jupyterhub/k8s-hub :3.2.1	2528c6e57587	jupyterhub@4.0.2	4.1.0

Open the chart page →

14,094

daskcloudnativeapp

1 of 2 See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
daskdev/dask-notebook :1.1.0	052630f5ca04	jupyterhub@0.9.4	4.1.0

Open the chart page →

29,901

1 of 7 See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
aristidetm/basic-notebook :3.6.5	469dbc951224	jupyterhub@4.0.1	4.1.0

Open the chart page →

16,604

ikigaiikigai-chart

1 of 58 See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
jupyterhub/k8s-hub :1.2.0	e4770285aaf7	jupyterhub@1.5.0	4.1.0

Open the chart page →

37,671

jupyterhubkubeblocks

2 of 7 See more

jupyterhub kubeblocks 0.1.0

2 of the 7 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
jupyterhub/k8s-hub :3.0.1-0.dev.git.6287.hbfb05cd6	5a0ceed1300a	jupyterhub@4.0.2	4.1.0
jupyterhub/k8s-singleuser-sample :3.0.1-0.dev.git.6287.hbfb05cd6	8e4778efec8e	jupyterhub@4.0.2	4.1.0

Open the chart page →

7,356

nubladolsst-sqre

3 of 5 See more

nublado lsst-sqre 0.9.23

3 of the 5 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
lsstsqre/prepuller :latest	19c2dfc4e4ff	jupyterhub@1.4.0	4.1.0
lsstsqre/sciplat-hub :latest	5e0ade6bed1c	jupyterhub@1.3.0	4.1.0
lsstsqre/wfdispatcher :latest	e9feb99f524d	jupyterhub@1.3.0	4.1.0

Open the chart page →

5,786

nublado2lsst-sqre

1 of 2 See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	jupyterhub@2.1.1	4.1.0

Open the chart page →

17,779

jupyterhubuninettsigma2

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2024-28233.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	jupyterhub@3.0.0	4.1.0

Open the chart page →

8,607

Container images carrying it

14 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
aristidetm/basic-notebook :3.6.5	469dbc951224	jupyterhub@4.0.1	4.1.0	1
daskdev/dask-notebook :1.1.0	052630f5ca04	jupyterhub@0.9.4	4.1.0	1
jupyterhub/k8s-hub :3.0.1-0.dev.git.6287.hbfb05cd6	5a0ceed1300a	jupyterhub@4.0.2	4.1.0	1
jupyterhub/k8s-hub :0.11.1	b6b4a1a34bf0	jupyterhub@1.3.0	4.1.0	1
jupyterhub/k8s-hub :1.2.0	e4770285aaf7	jupyterhub@1.5.0	4.1.0	1
jupyterhub/k8s-singleuser-sample :3.0.1-0.dev.git.6287.hbfb05cd6	8e4778efec8e	jupyterhub@4.0.2	4.1.0	1
jupyterhub/k8s-singleuser-sample :0.11.1	e3e6f3051df8	jupyterhub@1.3.0	4.1.0	1
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	jupyterhub@2.1.1	4.1.0	1
lsstsqre/prepuller :latest	19c2dfc4e4ff	jupyterhub@1.4.0	4.1.0	1
lsstsqre/sciplat-hub :latest	5e0ade6bed1c	jupyterhub@1.3.0	4.1.0	1
lsstsqre/wfdispatcher :latest	e9feb99f524d	jupyterhub@1.3.0	4.1.0	1
pangeo/base-notebook :2024.01.15	5fbe688a4f80	jupyterhub@4.0.2	4.1.0	1
quay.io/jupyterhub/k8s-hub :3.2.1	2528c6e57587	jupyterhub@4.0.2	4.1.0	1
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	jupyterhub@3.0.0	4.1.0	1