Read the docs
TI-2026-71828 Aliases CVE-2026-102832GHSA-jwrc-gm9j-263p

Trust prompt in JupyterLab can mark the wrong document as trusted

Priority LOW 19CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

JupyterLab from 4.5.7 before 4.5.11 and from 4.6.0 before 4.6.4 is affected, as are notebook from 7.5.6 before 7.6.3 and jupyterlite-core from 0.7.5 before 0.8.4. The trust prompt uses the currently active document when the user answers instead of the document whose command button was clicked (CWE-367). If another document becomes active while the prompt is open and the user chooses Trust, that document is trusted instead. A remote attacker needs the user to make that choice.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Applications that bundle JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior. This issue is fixed in versions 4.5.11 and 4.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00143 3rd percentileScored 2026-11-07
Fix Partial jupyterlab (jupyterlab): 4.5.11, 4.6.4jupyterlite-core (jupyterlab): 0.8.4+4 more productsRed Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jupyterlabjupyterlab4.5.7 to before 4.5.11; 4.6.0 to before 4.6.44.5.11, 4.6.4Patch availableCNA
jupyterlabjupyterlite-core0.7.5 to before 0.8.40.8.4Patch availableCNA
jupyterlabnotebook7.5.6 to before 7.6.37.6.3Patch availableCNA
—jupyterlab (PyPI)4.6.0 to before 4.6.44.6.4Patch availableGHSA-jwrc-gm9j-263p
—jupyterlab (PyPI)4.5.7 to before 4.5.114.5.11Patch availableGHSA-jwrc-gm9j-263p
—notebook (PyPI)7.5.6 to before 7.6.37.6.3Patch availableGHSA-jwrc-gm9j-263p
—jupyterlite-core (PyPI)0.7.5 to before 0.8.40.8.4Patch availableGHSA-jwrc-gm9j-263p
  • jupyterlab Vendorjupyterlab Affected 4.5.7 to before 4.5.11; 4.6.0 to before 4.6.4 Fixed in 4.5.11, 4.6.4 Patch available CNA
  • jupyterlite-core Vendorjupyterlab Affected 0.7.5 to before 0.8.4 Fixed in 0.8.4 Patch available CNA
  • notebook Vendorjupyterlab Affected 7.5.6 to before 7.6.3 Fixed in 7.6.3 Patch available CNA
  • jupyterlab (PyPI) Vendor— Affected 4.6.0 to before 4.6.4 Fixed in 4.6.4 Patch available GHSA-jwrc-gm9j-263p
  • jupyterlab (PyPI) Vendor— Affected 4.5.7 to before 4.5.11 Fixed in 4.5.11 Patch available GHSA-jwrc-gm9j-263p
  • notebook (PyPI) Vendor— Affected 7.5.6 to before 7.6.3 Fixed in 7.6.3 Patch available GHSA-jwrc-gm9j-263p
  • jupyterlite-core (PyPI) Vendor— Affected 0.7.5 to before 0.8.4 Fixed in 0.8.4 Patch available GHSA-jwrc-gm9j-263p

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*——jupyterlab
  • cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:* Versions — — ·jupyterlab

Remediation

Upgrade JupyterLab to 4.5.11 or 4.6.4, notebook to 7.6.3, and jupyterlite-core to 0.8.4. Red Hat reports no available fix for Red Hat OpenShift AI (RHOAI).

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA jupyterlab (jupyterlab) Fixed in 4.5.11, 4.6.4
  • Fix · CNA jupyterlite-core (jupyterlab) Fixed in 0.8.4
  • Fix · CNA notebook (jupyterlab) Fixed in 7.6.3
  • Fix · GHSA-jwrc-gm9j-263p jupyterlab (PyPI) Fixed in 4.6.4 Advisory →
  • Fix · GHSA-jwrc-gm9j-263p jupyterlab (PyPI) Fixed in 4.5.11 Advisory →
  • Fix · GHSA-jwrc-gm9j-263p notebook (PyPI) Fixed in 7.6.3 Advisory →
  • Fix · GHSA-jwrc-gm9j-263p jupyterlite-core (PyPI) Fixed in 0.8.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-102832
  2. 2026-10-13 CISA SSVC decision points changed
  3. 2026-10-15 Affected versions changed · Red Hat
  4. 2026-10-15 CVSS score added · Red Hat
  5. 2026-10-16 Alias added: GHSA-jwrc-gm9j-263p
  6. 2026-10-16 Fix available: PyPI/[email protected], PyPI/[email protected], PyPI/[email protected] +1 · GHSA-jwrc-gm9j-263p
  7. 2026-10-16 CVSS score added · GHSA-jwrc-gm9j-263p
  8. 2026-10-16 Weakness changed · GHSA-jwrc-gm9j-263p
  9. 2026-10-16 8 new references · GHSA-jwrc-gm9j-263p

References

Advisory 1

Other 7

  • TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
  • TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
  • TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
  • TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
  • TI-2026-78983 Path traversal in nbconvert lets crafted notebooks write files CVSS 4.0HIGH 8.8
  • TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
See all 89 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences