CRITICALCVSS 9.0EPSS 0.9%

CVE-2025-32428

TigerVNC accessible via the network and not just via a UNIX socket as intended

Published: 2025-04-12
Modified: 2026-10-27
EPSS percentile: 60%
Aliases: GHSA-vrq4-9hc3-cgp7
Sources: github-advisory

Summary

## Summary `jupyter-remote-desktop-proxy` was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by `jupyter-remote-desktop-proxy` were still accessible via the network. This vulnerability does not affect users having TurboVNC as the `vncserver` executable. ## Credits This vulnerability was identified by Arne Gottwald at University of Göttingen and analyzed, reported, and reviewed by @frejanordsiek.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	jupyter-remote-desktop-proxy	—	3.0.1

Remediation: Upgrade to 3.0.1 or later.

References

https://github.com/advisories/GHSA-vrq4-9hc3-cgp7

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.