Medium severity5.3NVD Advisory· Published May 23, 2024· Updated Apr 15, 2026
CVE-2024-28188
CVE-2024-28188
Description
Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
jupyter-schedulerPyPI | >= 1.0.0, < 1.1.6 | 1.1.6 |
jupyter-schedulerPyPI | >= 1.2.0, < 1.2.1 | 1.2.1 |
jupyter-schedulerPyPI | >= 1.3.0, < 1.8.2 | 1.8.2 |
jupyter-schedulerPyPI | >= 2.0.0, < 2.5.2 | 2.5.2 |
Patches
4d428ac871909Merge pull request from GHSA-v9g2-g7j4-4jxc
1 file changed · +1 −0
jupyter_scheduler/handlers.py+1 −0 modified@@ -355,6 +355,7 @@ async def get(self): class RuntimeEnvironmentsHandler(ExtensionHandlerMixin, JobHandlersMixin, APIHandler): + @authenticated async def get(self): """Returns names of available runtime environments and output formats mappings""" try:
a621b3863972Merge pull request from GHSA-v9g2-g7j4-4jxc
1 file changed · +1 −0
jupyter_scheduler/handlers.py+1 −0 modified@@ -299,6 +299,7 @@ async def get(self): class RuntimeEnvironmentsHandler(ExtensionHandlerMixin, JobHandlersMixin, APIHandler): + @tornado.web.authenticated async def get(self): """Returns names of available runtime environments and output formats mappings""" try:
f4137a779fdfMerge pull request from GHSA-v9g2-g7j4-4jxc
1 file changed · +1 −0
jupyter_scheduler/handlers.py+1 −0 modified@@ -355,6 +355,7 @@ async def get(self): class RuntimeEnvironmentsHandler(ExtensionHandlerMixin, JobHandlersMixin, APIHandler): + @authenticated async def get(self): """Returns names of available runtime environments and output formats mappings""" try:
06435a2277bbMerge pull request from GHSA-v9g2-g7j4-4jxc
1 file changed · +1 −0
jupyter_scheduler/handlers.py+1 −0 modified@@ -355,6 +355,7 @@ async def get(self): class RuntimeEnvironmentsHandler(ExtensionHandlerMixin, JobHandlersMixin, APIHandler): + @authenticated async def get(self): """Returns names of available runtime environments and output formats mappings""" try:
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- github.com/advisories/GHSA-v9g2-g7j4-4jxcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-28188ghsaADVISORY
- github.com/jupyter-server/jupyter-scheduler/commit/06435a2277bb2b8f441ec9cedafa474572b92c5dghsaWEB
- github.com/jupyter-server/jupyter-scheduler/commit/a621b386397280cc8ee5a208dca4607cb71cdd65ghsaWEB
- github.com/jupyter-server/jupyter-scheduler/commit/d428ac871909444e175ba421bf8ab4980d6ebf9fghsaWEB
- github.com/jupyter-server/jupyter-scheduler/commit/f4137a779fdf0cc4a9688a42dd8c6e7ade60f044ghsaWEB
- github.com/jupyter-server/jupyter-scheduler/security/advisories/GHSA-v9g2-g7j4-4jxcnvdWEB
- github.com/jupyter-server/jupyter_server/pull/1392nvdWEB
News mentions
0No linked articles in our index yet.