Impact and Remediation of CVE-2021-32798 in SystemLink Server

Issue Details

My IT department found Common Vulnerabilities and Exposures (CVE) entry CVE-2021-32798 for the SystemLink Server product.  What actions can I take to avoid or mitigate this vulnerability?

Solution

To mitigate or eliminate the security risk associated with CVE-2021-32798, choose one of the following options:
       

• Upgrade to SystemLink Server 2026 Q3 (or later):
  • SystemLink Server 2026 Q3 changes the execution behavior so that code in the integrated JupyterHub runs using the Windows permissions of the logged-in SystemLink user rather than administrative permissions-- this minimizes the vulnerability.

• Transition to the Next-Generation SystemLink Product
  • Migrate to the new SystemLink product (releasing Fall 2026), which includes an updated version of Jupyter that is not impacted by CVE-2021-32798.

Additional Information

Vulnerability CVE-2021-32798 affects SystemLink Server 2023 Q1 and later versions, because they all ship JupyterHub version 6.0.3.

Originally, CVE-2021-32798 listed the affected jupyter versions as:  5.7.0 <= jupyter < 5.7.11.  This did not affect modern SystemLink Server versions.
On June 16, 2026, CVE-2021-32798 added affected versions to include:  6.0.0 <= jupyter < 6.4.1.

SystemLink Server has shipped with Jupyter version 6.0.3 since SystemLink Server 2023 Q1.

The core of vulnerability CVE-2021-32798 is that Jupyter notebooks executing with sufficient privileges can change important files in Windows folders (on the SystemLink Server computer).  Any SystemLink Server versions prior to 2026 Q3 executed Jupyter notebooks with administrative permissions.