CVE-2026-86044
CriticalCVSS 9.6Summary
JupyterLab Desktop prior to 4.6.2-1 exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook; if the victim clicks it, the renderer navigates to an attacker-controlled site that retains access to the preload bridge, calls getServerInfo to obtain the local server URL and authentication token, and uses the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim.
Risk Assessment
An attacker can take control of the local Jupyter server and execute arbitrary code with the victim's privileges, leading to full compromise of the workstation and user data.
Recommendation
Update JupyterLab Desktop to version 4.6.2-1 or later; environments already using JupyterLab 4.4.8+ are less exposed, but updating the application is still recommended.
Other vulnerabilities in JupyterLab Desktop
See all- CVE-2025-55002Medium
JupyterLab Desktop for macOS prior to 4.6.2-1 shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected.
- CVE-2025-54991Medium
JupyterLab Desktop for macOS prior to 4.6.2-1 declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who can already execute code as the current user can load an arbitrary dynamic library into the JupyterLab Desktop process and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected.
- CVE-2026-102530Critical
JupyterLab Desktop prior to 4.6.2-1 inserted remote-server URLs into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user's privileges; a separate path involves unsafe rendering of RSS news-feed titles.
Original NVD description (English source)
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook. If a victim opens the notebook and clicks the link, the existing renderer navigates to an attacker-controlled site while retaining access to the preload bridge. The site can call getServerInfo to obtain the local server URL and authentication token, then use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. Users whose environment already uses JupyterLab 4.4.8 or later are unaffected because the corrected link handling breaks the first step of the chain. This vulnerability is fixed in 4.6.2-1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS