GHSA-5jhc-4h3c-q97h: 
JupyterHub vulnerability analysis and mitigation

Summary

When setgroups fails, LocalProcessSpawner may fail to drop group membership of the Hub process.

Impact

When the setgroups syscall fails (rare), supplemental groups may be inherited from the Hub parent process.

Workarounds

First, make sure setgroups succeeds for user subprocesses. If it does, then there's no problem. If it fails in your case, you can subclass LocalProcessSpawner with a custom make_preexec_fn that drops supplemental groups by calling:

user = pwd.getpwnam(username)
uid = user.pw_uid
gid = user.pw_gid
os.setgid(gid)
os.setgroups([]) # the difference
os.setuid(uid)

If setgroups succeeds, as it does on almost all real systems, there is no issue.

Patch

Upgrade to JupyterHub 6.1.0 or 5.5.3.