CVE-2026-42557
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
67/100
Published: 2026-05-13
Modified: 2026-10-25
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Active
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user. This vulnerability is fixed in 4.5.7.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| jupyter | jupyterlab | < 4.5.7 |
| jupyter | notebook | 7.0.0 – 7.5.6 |
References & Advisories (6)
Mitigation
Vendor Advisory