# CVE-2026-102530: JupyterLab Desktop cross-site scripting in server URL and RSS feed rendering

Source: https://junglewise.ai/threats/cve-2026-102530-jupyterlab-desktop-is-the-cross-platform-desktop-application-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-102530 · Severity: info · Published 2026-11-06

JupyterLab Desktop is a cross-platform application for running Jupyter notebooks locally or connecting to remote servers. An attacker can craft a malicious server URL that, when a user pastes it into the connection dialog, executes arbitrary JavaScript code with the user's privileges. A second attack path exists through RSS feed titles in the news section, which could be exploited by someone controlling the blog feed or its cached data on the user's machine.

Technologies: [JupyterLab Desktop](https://junglewise.ai/threats/technologies/jupyterlab-desktop). Vendors: [JupyterLab](https://junglewise.ai/threats/vendors/jupyterlab).

## Quick answers

**Is CVE-2026-102530 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102530 being exploited in the wild.

**How severe is CVE-2026-102530?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** JupyterLab Desktop prior to 4.6.2-1.

**Is there a fix for CVE-2026-102530?** Yes: fixed in 4.6.2-1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102530 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-102530?** Check whether you run JupyterLab Desktop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.6.2-1

## Technical details

The vulnerability is an unsafe innerHTML insertion (XSS) affecting two code paths: remote-server URLs concatenated directly into the DOM in the server-selection dialog and Welcome view, and RSS news-feed titles rendered without encoding. An attacker can exploit the first path by convincing a user to paste a crafted URL, or the second by compromising feed content or cached feed data. The privileged IPC bridge allows JavaScript executed in the Welcome renderer to escape the renderer process and execute arbitrary code with user privileges.

## Affected products

- JupyterLab Desktop prior to 4.6.2-1

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d](https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d)
- [https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1](https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1)

## Related threats

- [JupyterLab Desktop server token leak in untrusted notebook](https://junglewise.ai/threats/cve-2026-86044-jupyterlab-desktop-is-the-cross-platform-desktop-application-for)
- [JupyterLab Desktop TCC bypass via dyld environment variable on macOS](https://junglewise.ai/threats/cve-2025-54991-jupyterlab-desktop-is-the-cross-platform-desktop-application-for)