Read the docs
TI-2026-65520 Aliases CVE-2026-102831GHSA-6966-vjj6-99xv

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

Priority LOW 37CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345 and CWE-79.

Summary

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Partial jupyterlab (jupyterlab): 4.5.11, 4.6.4notebook (jupyterlab): 7.6.3+5 more productsRed Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jupyterlabjupyterlab4.5.0 to before 4.5.11; 4.6.0 to before 4.6.44.5.11, 4.6.4Patch availableCNA
jupyterlabnotebook7.5.0 to before 7.6.37.6.3Patch availableCNA
jupyterlabjupyterlite-core0.7.0 to before 0.8.40.8.4Patch availableCNA
—jupyterlab (PyPI)4.6.0 to before 4.6.44.6.4Patch availableGHSA-6966-vjj6-99xv
—jupyterlab (PyPI)4.5.0 to before 4.5.114.5.11Patch availableGHSA-6966-vjj6-99xv
—notebook (PyPI)7.5.0 to before 7.6.37.6.3Patch availableGHSA-6966-vjj6-99xv
—jupyterlite (PyPI)0.7.0 to before 0.8.40.8.4Patch availableGHSA-6966-vjj6-99xv
—jupyterlite-core (PyPI)0.7.0 to before 0.8.40.8.4Patch availableGHSA-6966-vjj6-99xv
  • jupyterlab Vendorjupyterlab Affected 4.5.0 to before 4.5.11; 4.6.0 to before 4.6.4 Fixed in 4.5.11, 4.6.4 Patch available CNA
  • notebook Vendorjupyterlab Affected 7.5.0 to before 7.6.3 Fixed in 7.6.3 Patch available CNA
  • jupyterlite-core Vendorjupyterlab Affected 0.7.0 to before 0.8.4 Fixed in 0.8.4 Patch available CNA
  • jupyterlab (PyPI) Vendor— Affected 4.6.0 to before 4.6.4 Fixed in 4.6.4 Patch available GHSA-6966-vjj6-99xv
  • jupyterlab (PyPI) Vendor— Affected 4.5.0 to before 4.5.11 Fixed in 4.5.11 Patch available GHSA-6966-vjj6-99xv
  • notebook (PyPI) Vendor— Affected 7.5.0 to before 7.6.3 Fixed in 7.6.3 Patch available GHSA-6966-vjj6-99xv
  • jupyterlite (PyPI) Vendor— Affected 0.7.0 to before 0.8.4 Fixed in 0.8.4 Patch available GHSA-6966-vjj6-99xv
  • jupyterlite-core (PyPI) Vendor— Affected 0.7.0 to before 0.8.4 Fixed in 0.8.4 Patch available GHSA-6966-vjj6-99xv

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*——jupyterlab
  • cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* Versions — — ·jupyterlab

Remediation

  • Fix · CNA jupyterlab (jupyterlab) Fixed in 4.5.11, 4.6.4
  • Fix · CNA notebook (jupyterlab) Fixed in 7.6.3
  • Fix · CNA jupyterlite-core (jupyterlab) Fixed in 0.8.4
  • Fix · GHSA-6966-vjj6-99xv jupyterlab (PyPI) Fixed in 4.6.4 Advisory →
  • Fix · GHSA-6966-vjj6-99xv jupyterlab (PyPI) Fixed in 4.5.11 Advisory →
  • Fix · GHSA-6966-vjj6-99xv notebook (PyPI) Fixed in 7.6.3 Advisory →
  • Fix · GHSA-6966-vjj6-99xv jupyterlite (PyPI) Fixed in 0.8.4 Advisory →
  • Fix · GHSA-6966-vjj6-99xv jupyterlite-core (PyPI) Fixed in 0.8.4 Advisory →

Red Hat 2 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Not affected: 4 products
  • Migration Toolkit for Applications 8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102831
  2. 2026-10-03 Alias added: GHSA-6966-vjj6-99xv
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-18 Affected versions changed · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  7. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  8. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat

References

Advisory 1

Other 7

  • TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
  • TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
  • TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
  • TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
  • TI-2026-78983 Path traversal in nbconvert lets crafted notebooks write files CVSS 4.0HIGH 8.8
  • TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
See all 89 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences