Read the docs
TI-2026-86116 Aliases CVE-2026-86044

JupyterLab Desktop token leak via crafted link enables remote code execution

Priority MEDIUM 41CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

JupyterLab Desktop before 4.6.2-1 exposed getServerInfo to the renderer without checking the page origin. An attacker can plant a crafted MathJax link in an untrusted notebook when JupyterLab is before 4.4.8. When a victim clicks it, the renderer navigates to an attacker site that keeps the preload bridge, calls getServerInfo for the server URL and token, and uses the REST API to create and trust a notebook that runs arbitrary code as the victim. JupyterLab 4.4.8 or later is unaffected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook. If a victim opens the notebook and clicks the link, the existing renderer navigates to an attacker-controlled site while retaining access to the preload bridge. The site can call getServerInfo to obtain the local server URL and authentication token, then use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. Users whose environment already uses JupyterLab 4.4.8 or later are unaffected because the corrected link handling breaks the first step of the chain. This vulnerability is fixed in 4.6.2-1.

Why it matters now

EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed jupyterlab-desktop (jupyterlab): 4.6.2-1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jupyterlabjupyterlab-desktopbefore 4.6.2-14.6.2-1Patch availableCNA
  • jupyterlab-desktop Vendorjupyterlab Affected before 4.6.2-1 Fixed in 4.6.2-1 Patch available CNA

Remediation

Upgrade JupyterLab Desktop to version 4.6.2-1 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA jupyterlab-desktop (jupyterlab) Fixed in 4.6.2-1

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-86044

References

Other 3

  • TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
  • TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
  • TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
  • TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
  • TI-2026-78983 Path traversal in nbconvert lets crafted notebooks write files CVSS 4.0HIGH 8.8
  • TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
See all 89 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences