Is binderhub safe to use?

binderhub has 2 known vulnerabilities on the latest version (0.1.0). DepScope rates its health at 17/100 (critical risk).

What is the latest version of binderhub?

The latest version of binderhub is 0.1.0, released 2018-11-07.

Does binderhub have known vulnerabilities?

Yes. binderhub has 2 known vulnerabilities. See depscope.dev/pkg/pypi/binderhub for details.

Is binderhub deprecated?

No, binderhub is actively maintained. Latest release: 0.1.0 (2018-11-07).

What are alternatives to binderhub?

Popular alternatives to binderhub in PyPI include: boto3, packaging, urllib3, certifi, idna.

What license does binderhub use?

binderhub is licensed under BSD.

binderhub

pypiv0.1.0

Turn a Git repo into a collection of interactive notebooks

License BSDpermissive1 versions1 maintainers9 deps

jupyterhub/binderhub/

/ 100

Health

do not use

binderhub has critical vulnerabilities — do not use

Update to >= 0.2.0-n653 to fix known vulnerabilities

Low health score (17/100)
1 critical vulnerabilities

Health breakdown0 – 100

0/25

maintenance

0/20

popularity

15/25

security

0/15

maturity

2/15

community

Vulnerabilities

1 critical1 low

Advisories (2)

Severity	ID	Summary	Fixed in
critical	CVE-2021-39159	remote code execution via git repo provider	0.2.0
unknown	CVE-2021-39159	BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credenti	0.2.0-n653

Health History

Dependency Tree

License Audit

Dependencies (9)

kubernetes escapism tornado traitlets docker jinja2 prometheus-client python-json-logger jupyterhub

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/pypi/binderhub