Most recent entries from all

EUVD-2026-10000

2026-10-20T18:12:03.883983+00:00

EUVD-2026-10000

fkie_cve-2023-48311

2026-10-20T18:12:03.884040+00:00

dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.

GHSA-hfgr-h3vc-p6c2 — DockerSpawner allows any image by default

2026-10-20T18:12:03.884092+00:00

Affected: PyPI: dockerspawner

### Impact

Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable image, instead of restricting to only the single configured image, as intended.

### Patches

Upgrade to DockerSpawner 13.

### Workarounds

Explicitly setting `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior:

```python c.DockerSpawner.image = "your-image" c.DockerSpawner.allowed_images = ["your-image"] ```

gsd-2023-48311

2026-10-20T18:12:03.884127+00:00