Executive brief
JupyterLab and Jupyter Notebook are popular web-based platforms used for data science and scientific computing. A vulnerability in how these platforms handle certain HTML elements allows an attacker to create a malicious notebook or Markdown file that executes unauthorized commands when a user clicks a button. This could lead to arbitrary code execution, data loss through file deletion, or service disruption, potentially compromising the user's entire research environment.
Technical details
The vulnerability exists because JupyterLab's HTML sanitizer allowlists 'data-commandlinker-command' and 'data-commandlinker-args' attributes on button elements. Simultaneously, the 'CommandLinker' component listens for click events globally on the document body and executes the specified command without verifying if the source element originated from a trusted part of the JupyterLab UI. An attacker can craft a notebook with pre-saved HTML output containing a deceptive button that, when clicked by a victim, triggers arbitrary internal commands. This can result in arbitrary code execution within the kernel, silent file deletion, or denial of service. The attack requires user interaction (a single click) but does not require an active kernel to be running at the time the notebook is opened.
Affected products
- Jupyter jupyterlab <= 4.5.6
- Jupyter notebook >= 7.0.0, <= 7.5.5
Timeline
- 2026-04-30: disclosed: Initial disclosure by krassowski
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-13: other: NVD publication date