hey @pradeeban Sir see this :
In main.py:398-408, the /openJupyter endpoint launches a Jupyter Lab process with zero authentication:
@app.route('/openJupyter/', methods=['POST'])
def openJupyter():
proc = subprocess.Popen(['jupyter', 'lab'], shell=False, stdout=subprocess.PIPE, cwd=concore_path)
Any user hitting POST /openJupyter can spawn a Jupyter Lab server on the host machine, giving full code execution access. There's no API key check, no rate limiting, and no way to stop the launched process. Additionally, each call spawns a new process that is never cleaned up (resource leak). This endpoint should either require authentication or be removed entirely.
hey @pradeeban Sir see this :
In main.py:398-408, the /openJupyter endpoint launches a Jupyter Lab process with zero authentication:
Any user hitting POST /openJupyter can spawn a Jupyter Lab server on the host machine, giving full code execution access. There's no API key check, no rate limiting, and no way to stop the launched process. Additionally, each call spawns a new process that is never cleaned up (resource leak). This endpoint should either require authentication or be removed entirely.