Executive brief
JupyterLab is a web-based environment for interactive computing and notebook authoring. A flaw in its settings import feature allows crafted configuration files to execute arbitrary code with the privileges of the user running JupyterLab. An attacker can trick a user into importing a malicious settings file or place one in a shared location, gaining the ability to read, modify, or delete notebooks and run code on connected compute kernels.
Technical details
The vulnerability is an unsafe DOM injection in the notebook settings handler, specifically affecting the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings in packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts. These settings are inserted directly into CSS without sanitization, allowing an attacker to inject malicious JavaScript through crafted values in an overrides.json file. Attack vectors include explicit user import via the Settings Editor's Import button, or automatic application of a malicious overrides.json planted in a shared settings location. The embedded code runs with full notebook server access and can execute arbitrary operations. Patches were released in versions 4.5.10 and 4.6.2.
Affected products
- Project Jupyter JupyterLab 3.3.0 through 4.5.9, 4.6.0 through 4.6.1
Timeline
- 2026-07-21: patched: Security patches released in versions 4.5.10 and 4.6.2
- 2026-08-13: disclosed