Regular Expression without Anchors Affecting jupyter-server package, versions [,2.18.0)

Affected versions of this package are vulnerable to Regular Expression without Anchors through the allow_origin_pat checks in websocket.py, login.py. An attacker can bypass CORS, WebSocket origin checks, and login redirect validation by supplying an Origin or Referer value that matches the configured pattern only as a prefix, such as a trusted hostname followed by attacker-controlled suffixes. This lets a malicious site make authenticated requests or steer redirects to an attacker-controlled origin, exposing user data and enabling cross-site actions in deployments that rely on allow_origin_pat for origin restrictions.

Workarounds

• Wrap your allow_origin_pat value with ^ and $ so it matches the full origin string instead of only a prefix; this prevents attacker-controlled origins like trusted.example.com.evil.com from passing origin validation.

• GitHub Commit
• Maintainer's Advisory